API endpoints
All endpoints live under /api/* as Vercel serverless functions. Files with a leading underscore
(_tenant.js, _session.js, _odoo.js, _hubspot.js) are helpers — imported by the routes,
not routed themselves.
Public (no session)
Section titled “Public (no session)”| Endpoint | Method | Purpose |
|---|---|---|
/api/tenant |
GET | Current tenant’s non-secret branding (slug, name, brand), resolved by host. Used by brand.js. |
/api/catalog |
GET | The tenant’s catalogue as window.CATALOG, with live Odoo prices overlaid by SKU. |
/api/unlock |
POST | Log in with an access code → sets the viz_auth session cookie. |
/api/build |
GET | Re-open a saved build by rego + mobile (both required); grants a 2 h read-only view session. |
/api/sms-inbound |
POST | Twilio inbound-SMS webhook → forwards to GoAsk Answer. |
/api/tileskey |
GET | Serves the Google Map Tiles key to the drive page (gated by a valid viz_auth). |
/api/logout |
GET/POST | Clears the session cookies. |
Session required
Section titled “Session required”| Endpoint | Method | Role | Purpose |
|---|---|---|---|
/api/lead |
POST | any session | Save the lead + fan out the quote (Supabase → email backup → Answer → HubSpot → Odoo). |
/api/leads |
GET, DELETE | staff | List / delete leads. |
/api/users |
GET, POST, PATCH, DELETE | staff | People & Access — create, edit, revoke users. |
/api/event |
POST | session | Write a funnel-analytics event. |
/api/events |
GET | staff | Read funnel analytics for the dashboard. |
/api/sms |
POST | session | Outbound SMS via Twilio → feeds GoAsk Answer. |
/api/email |
POST | session | Send an email via Resend. |
/api/dealer |
POST | dealer | Compute margin / commission for a build (server-only cost ratios). |
/api/dealerportal |
GET | dealer:<slug> |
The dealer’s proposals / pipeline. |
/api/dealstatus |
POST | dealer/staff | Update a proposal status: proposed ↔ converted. |
/api/manufacturer |
GET | mfr | Product demand across all dealers. |
Response contract for integrations
Section titled “Response contract for integrations”/api/lead returns an honest result — the customer flow is never blocked by a CRM outage:
{ "ok": true, "safe": true, "stored": true, "notified": false, "crm": true, "hubspot": true, "odoo": true}safe is true when the lead landed somewhere (database or email backup). crm / hubspot /
odoo report each downstream push independently.