API Route Reference
Relevant source files
The following files were used as context for generating this wiki page:
The DRX CRM API provides a robust, tenant-isolated backend infrastructure for managing point-of-sale (POS) operations, inventory traceability, and customer relationships. Built using Next.js Server Actions and standard RESTful routes, the API enforces strict Row Level Security (RLS) and role-based access control (RBAC) at the database layer to ensure data integrity and privacy compliance.
The API is structured to support multi-tenancy, where every request is validated against a business_id to maintain strict isolation between different business entities. Key subsystems include Audit Logging, Team Management, Inventory Intake, and Right to be Forgotten (RTBF) compliance endpoints.
Sources: README.md:1-20, testsprite_tests/standard_prd.json:8-15
Core Administrative APIs
Audit Logs API
The Audit Logs API provides append-only, tenant-isolated access to system events. It captures sensitive actions such as price overrides, inventory adjustments, and permission modifications.
| Parameter | Type | Description |
|---|---|---|
business_id | UUID | (Required) The unique identifier for the tenant. |
action | String | Filter logs by specific action (e.g., "Price Override"). |
type | String | Filter by event type. |
Sources: testsprite_tests/standard_prd.json:58-85
Team Management API
This API handles user provisioning and role assignments within a business. It enforces a strict role hierarchy where, for example, Managers are restricted from assigning or modifying Owner roles.
The diagram illustrates the internal validation logic used to prevent unauthorized role escalations during team management operations.
Sources: testsprite_tests/standard_prd.json:96-125, CHANGELOG.md:47-50
Inventory and POS APIs
Inventory Intake System
The intake API manages the workflow for receiving new stock. It supports derived cost-per-unit calculations and includes a manager approval gate for "unusual" cost deviations (typically >50%).
| Endpoint | Method | Description |
|---|---|---|
/api/inventory/intake | POST | Submits a new inventory intake record. |
/api/inventory/intake/approve | POST | Allows a manager to approve pending intakes. |
Sources: deploy-inventory-intake.sh:65-70, test-inventory-intake.sh:78-100
POS and Sales Integration
Sales transactions are handled through endpoints that ensure immutability once completed. The system supports fractional sales (for weight-based items) and validates price overrides against the user's role.
Sequence of a standard POS transaction ensuring stock validation and immutable record creation.
Sources: testsprite_tests/standard_prd.json:18-25, tests/event-desk-integration.spec.ts:40-60
Privacy and Compliance APIs
RTBF (Right to Be Forgotten) API
To comply with privacy regulations, the RTBF API provides a mechanism for permanent PII (Personally Identifiable Information) masking and tenant role removal.
- Endpoint:
/api/v1/tenant/{tenantId}/user/{userId}/delete - Logic: Instead of hard deletion, the API performs "soft-disabling" and PII masking to preserve historical financial audit integrity while removing identifiable user data.
Sources: testsprite_tests/standard_prd.json:145-175, CHANGELOG.md:65-67
Integration and External Sync
Help Center Sync
The system includes utility routes for synchronizing internal help documentation with external platforms (e.g., Featurebase). This is managed via the /v2/help_center routes.
High-level flow of the documentation synchronization process.
Sources: scripts/sync-help-center.ts:35-55, scripts/help-center-data.ts:1-20
Technical Summary
The DRX Primary API architecture prioritizes financial correctness and inventory traceability. By leveraging PostgreSQL's Row Level Security and Prisma ORM, the system ensures that no unlogged financial changes occur. All sensitive operations, from inventory intakes to role modifications, generate immutable audit trails that are accessible through the Audit Logs API.
Sources: testsprite_tests/standard_prd.json:28-35, README.md:120-130