API reference

GET /v1/health

The Worker answers, and which build it is

Anyone.

Operation health · added in PR 2. Public: no session needed. No token: the cookie or nothing.

Answers

• 200 HealthResponse: {status, commit, version}; touches no object

The answer, HealthResponse

curl

curl 'https://api.bakery.ihaveasegway.com/v1/health'

Copy the curl for health

GET /v1/status

Today's admission state, the status page's counters and the breaker's state, from the Control object

Anyone.

Operation status · added in PR 2. Public: no session needed. No token: the cookie or nothing.

Answers

• 200 StatusResponse: today's sandboxes, guests and demo accounts with their caps, the last snapshot of the kept Analytics Engine queries with counters_as_of and counters_state (live, stale or unavailable), the breaker's state (unconfigured, armed, read-only or off) with its last run, and the flag

The answer, StatusResponse

curl

curl 'https://api.bakery.ihaveasegway.com/v1/status'

Copy the curl for status

POST /v1/auth/demo

Create a demo account behind Turnstile; the username is shown once

Anyone; a session, if present, is read but not required. Carries an Idempotency-Key.

Operation demo-signup · added in PR 3. Public: no session needed. No token: the cookie or nothing.

Parameters

Request body, DemoSignupRequest

Answers

• 201 DemoSignupResponse: the generated username, and the cookie
• 400 Problem (problems: idempotency-key, body): idempotency-key: no Idempotency-Key, or not a ULID; body: a body that is not the contract's JSON
• 403 Problem (problems: turnstile, origin): turnstile: Turnstile refused the token; origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site
• 422 Problem (problems: password, idempotency-key): password: 12 to 128 characters; idempotency-key: the same key again with a different body
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, with Retry-After
• 503 Problem (problem: demo-cap): demo-cap: the day's demo accounts are used up

The answer, DemoSignupResponse

curl

curl -X POST 'https://api.bakery.ihaveasegway.com/v1/auth/demo' \
  -H 'Idempotency-Key: <a new ULID>' \
  -H 'Content-Type: application/json' \
  -d '{"password":"<string>","turnstile_token":"<string>"}'

Copy the curl for demo-signup

POST /v1/auth/demo/signin

Sign in to a demo account

Anyone; a session, if present, is read but not required. Carries an Idempotency-Key.

Operation demo-signin · added in PR 3. Public: no session needed. No token: the cookie or nothing.

Parameters

Request body, DemoSigninRequest

Answers

• 200 SessionResponse: the session, and the cookie
• 400 Problem (problems: idempotency-key, body): idempotency-key: no Idempotency-Key, or not a ULID; body: a body that is not the contract's JSON
• 401 Problem (problem: credentials): credentials: no such username, or the wrong password
• 403 Problem (problem: origin): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site
• 422 Problem (problem: idempotency-key): idempotency-key: the same key again with a different body
• 429 Problem (problems: locked, rate-limit): locked: 10 failures in 15 minutes; with Retry-After; rate-limit: the session's or IP hash's limit, with Retry-After

The answer, SessionResponse

curl

curl -X POST 'https://api.bakery.ihaveasegway.com/v1/auth/demo/signin' \
  -H 'Idempotency-Key: <a new ULID>' \
  -H 'Content-Type: application/json' \
  -d '{"username":"<string>","password":"<string>"}'

Copy the curl for demo-signin

GET /v1/auth/github/callback

GitHub's redirect back: the numeric user id is all it keeps

Anyone.

Operation github-callback · added in PR 3. Public: no session needed. No token: the cookie or nothing.

Parameters

Answers

• 303: to the storefront's path, setting __Host-session; to /signin/?error=state, exchange, token, provider or oauth

curl

curl 'https://api.bakery.ihaveasegway.com/v1/auth/github/callback'

Copy the curl for github-callback

GET /v1/auth/github/start

Start a GitHub sign-in

Anyone.

Operation github-start · added in PR 3. Public: no session needed. No token: the cookie or nothing.

Parameters

Answers

• 302: to GitHub with no scope parameter; sets __Host-oauth

curl

curl 'https://api.bakery.ihaveasegway.com/v1/auth/github/start'

Copy the curl for github-start

GET /v1/auth/google/callback

Google's redirect back: the `__Host-oauth` cookie and `state` are the check

Anyone.

Operation google-callback · added in PR 3. Public: no session needed. No token: the cookie or nothing.

Parameters

Answers

• 303: to the storefront's path, setting __Host-session; to /signin/?error=state, exchange, token, provider or oauth

curl

curl 'https://api.bakery.ihaveasegway.com/v1/auth/google/callback'

Copy the curl for google-callback

GET /v1/auth/google/start

Start a Google sign-in

Anyone.

Operation google-start · added in PR 3. Public: no session needed. No token: the cookie or nothing.

Parameters

Answers

• 302: to Google with scope=openid alone; sets __Host-oauth

curl

curl 'https://api.bakery.ihaveasegway.com/v1/auth/google/start'

Copy the curl for google-start

POST /v1/auth/signout

Sign out: the cookie is cleared and an account's session id revoked

Any session, a guest's included. Carries an Idempotency-Key.

Operation signout · added in PR 3. Any session, a guest’s included. No token: the cookie or nothing.

Parameters

Answers

• 204: the cookie cleared
• 400 Problem (problems: idempotency-key, token): idempotency-key: no Idempotency-Key, or not a ULID; token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: an API token: this route takes the session cookie only (cookie-only); session: no session, or one that does not verify
• 403 Problem (problem: origin): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site
• 422 Problem (problem: idempotency-key): idempotency-key: the same key again with a different body
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, with Retry-After

This route takes the console’s cookie only, so a token cannot call it: a token never mints its successor, and a browser session is the only way to sign in.

GET /v1/session

What the cookie says, read without an object call

Any session, a guest's included.

Operation session · added in PR 3. Any session, a guest’s included. No token: the cookie or nothing.

Answers

• 200 SessionResponse: the cookie, decoded
• 400 Problem (problem: token): token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: an API token: this route takes the session cookie only (cookie-only); session: no session, or one that does not verify

The answer, SessionResponse

This route takes the console’s cookie only, so a token cannot call it: a token never mints its successor, and a browser session is the only way to sign in.

POST /v1/sandboxes

A sandbox: Turnstile for a guest, admitted by Control, seeded

Anyone; a session, if present, is read but not required. Carries an Idempotency-Key.

Operation create-sandbox · added in PR 3. Public: no session needed. No token: the cookie or nothing.

Parameters

Request body, CreateSandboxRequest

Answers

• 200 SandboxResponse: an account's live sandbox, unless replace
• 201 SandboxResponse: a new sandbox; the cookie is re-issued with sbx
• 400 Problem (problems: idempotency-key, body): idempotency-key: no Idempotency-Key, or not a ULID; body: a body that is not the contract's JSON
• 403 Problem (problems: turnstile, origin): turnstile: a guest without a good Turnstile token; origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site
• 422 Problem (problem: idempotency-key): idempotency-key: the same key again with a different body
• 429 Problem (problems: rate-limit, account-sandbox-cap): rate-limit: this IP hash's creations this minute; account-sandbox-cap: 3 sandboxes an account a day
• 503 Problem (problems: sandbox-cap, guest-cap, read-only, off): sandbox-cap: 300 sandboxes a UTC day; guest-cap: 100 guest sandboxes a UTC day; read-only: the demo's flag is read-only; off: the demo's flag is off

The answer, SandboxResponse

curl

curl -X POST 'https://api.bakery.ihaveasegway.com/v1/sandboxes' \
  -H 'Idempotency-Key: <a new ULID>' \
  -H 'Content-Type: application/json' \
  -d '{}'

Copy the curl for create-sandbox

DELETE /v1/sandboxes/{id}

Wipe now, finished in the request

A session of sandbox {id}, a guest's included. The sandbox's API token may stand in for the cookie.

Operation wipe-sandbox · added in PR 3. A session of this sandbox, a guest’s included. A token is accepted.

Parameters

Answers

• 200 WipedResponse: {id, state: wiped}; an account's cookie loses sbx, a guest's is cleared
• 400 Problem (problem: token): token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 403 Problem (problem: origin): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site
• 404 Problem: another sandbox's id, or one naming nothing
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, or with a token the token's, with Retry-After

The answer, WipedResponse

curl

curl -X DELETE 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>' \
  -H 'Authorization: Bearer <your token>'

Copy the curl for wipe-sandbox

GET /v1/sandboxes/{id}

The sandbox's state

A session of sandbox {id}, a guest's included. The sandbox's API token may stand in for the cookie.

Operation get-sandbox · added in PR 3. A session of this sandbox, a guest’s included. A token is accepted.

Parameters

Answers

• 200 SandboxResponse: the Sandbox's state
• 400 Problem (problem: token): token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 404 Problem: another sandbox's id, or one naming nothing
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 429 Problem (problem: rate-limit): rate-limit: with a token, the token's limit: every request it makes counts, with Retry-After

The answer, SandboxResponse

curl

curl 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>' \
  -H 'Authorization: Bearer <your token>'

Copy the curl for get-sandbox

POST /v1/sandboxes/{id}/clock

Move business time forward, at most 14 days in all

A signed-in session of sandbox {id}; a guest gets 403 guest-scope. The sandbox's API token may stand in for the cookie. Carries an Idempotency-Key.

Operation advance-clock · added in PR 4. A signed-in session of this sandbox; a guest gets 403 guest-scope. A token is accepted.

Parameters

Request body, ClockRequest

Answers

• 200 ClockResponse: the clock, with step; the same key again: the first answer, and nothing moves again
• 400 Problem (problems: idempotency-key, body, token): idempotency-key: no Idempotency-Key, or not a ULID; body: a body that is not the contract's JSON; token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 403 Problem (problems: origin, guest-scope): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site; guest-scope: a guest's session: sign in for this
• 404 Problem: another sandbox's id, or one naming nothing
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 422 Problem (problems: clock, idempotency-key): clock: naming offset-cap or not-positive (also for both or neither); idempotency-key: the same key again with a different body
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, or with a token the token's, with Retry-After

The answer, ClockResponse

curl

curl -X POST 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/clock' \
  -H 'Authorization: Bearer <your token>' \
  -H 'Idempotency-Key: <a new ULID>' \
  -H 'Content-Type: application/json' \
  -d '{}'

Copy the curl for advance-clock

GET /v1/sandboxes/{id}/dead-letters

The messages the Queue gave up on, oldest first

A session of sandbox {id}, a guest's included. The sandbox's API token may stand in for the cookie.

Operation list-dead-letters · added in PR 4. A session of this sandbox, a guest’s included. A token is accepted.

Parameters

Answers

• 200: an array of dead letters
• 400 Problem (problem: token): token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 404 Problem: another sandbox's id, or one naming nothing
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 429 Problem (problem: rate-limit): rate-limit: with a token, the token's limit: every request it makes counts, with Retry-After

curl

curl 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/dead-letters' \
  -H 'Authorization: Bearer <your token>'

Copy the curl for list-dead-letters

POST /v1/sandboxes/{id}/dead-letters/{eventId}/redrive

Send a dead letter again with its own id

A signed-in session of sandbox {id}; a guest gets 403 guest-scope. The sandbox's API token may stand in for the cookie. Carries an Idempotency-Key.

Operation redrive · added in PR 4. A signed-in session of this sandbox; a guest gets 403 guest-scope. A token is accepted.

Parameters

Answers

• 200 DeadLetter: the dead letter sent again, its row removed
• 400 Problem (problems: idempotency-key, token): idempotency-key: no Idempotency-Key, or not a ULID; token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 403 Problem (problems: origin, guest-scope): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site; guest-scope: a guest's session: sign in for this
• 404 Problem: an id this sandbox has not registered, another's included
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 422 Problem (problem: idempotency-key): idempotency-key: the same key again with a different body
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, or with a token the token's, with Retry-After

The answer, DeadLetter

curl

curl -X POST 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/dead-letters/<eventId>/redrive' \
  -H 'Authorization: Bearer <your token>' \
  -H 'Idempotency-Key: <a new ULID>'

Copy the curl for redrive

POST /v1/sandboxes/{id}/faults

Switch the Kitchen's or the Inbox's broken-subscriber fault

A signed-in session of sandbox {id}; a guest gets 403 guest-scope. The sandbox's API token may stand in for the cookie. Carries an Idempotency-Key.

Operation set-fault · added in PR 3. A signed-in session of this sandbox; a guest gets 403 guest-scope. A token is accepted.

Parameters

Request body, FaultRequest

Answers

• 200 FaultsResponse: every switch as it now stands
• 400 Problem (problems: idempotency-key, body, token): idempotency-key: no Idempotency-Key, or not a ULID; body: a body that is not the contract's JSON; token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 403 Problem (problems: origin, guest-scope): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site; guest-scope: a guest's session: sign in for this
• 404 Problem: another sandbox's id, or one naming nothing
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 422 Problem (problem: idempotency-key): idempotency-key: the same key again with a different body
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, or with a token the token's, with Retry-After

The answer, FaultsResponse

curl

curl -X POST 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/faults' \
  -H 'Authorization: Bearer <your token>' \
  -H 'Idempotency-Key: <a new ULID>' \
  -H 'Content-Type: application/json' \
  -d '{"fault":"inbox","on":false}'

Copy the curl for set-fault

GET /v1/sandboxes/{id}/menu

The published menu, with `ETag: "v<n>"`

A session of sandbox {id}, a guest's included. The sandbox's API token may stand in for the cookie.

Operation get-menu · added in PR 4. A session of this sandbox, a guest’s included. A token is accepted.

Parameters

Answers

• 200 MenuResponse: the Catalog's published menu
• 304: a matching If-None-Match
• 400 Problem (problem: token): token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 404 Problem: another sandbox's id, or one naming nothing
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 429 Problem (problem: rate-limit): rate-limit: with a token, the token's limit: every request it makes counts, with Retry-After
• 503 Problem (problem: seeding): seeding: the sandbox is still being seeded

The answer, MenuResponse

curl

curl 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/menu' \
  -H 'Authorization: Bearer <your token>'

Copy the curl for get-menu

PATCH /v1/sandboxes/{id}/menu/items/{slug}

A draft price on every variant, or a pause or resume published at once

A signed-in session of sandbox {id}; a guest gets 403 guest-scope. The sandbox's API token may stand in for the cookie.

Operation patch-menu-item · added in PR 4. A signed-in session of this sandbox; a guest gets 403 guest-scope. A token is accepted.

Parameters

Request body, MenuItemPatch

Answers

• 200 MenuEditResponse: {version, pending}
• 400 Problem (problems: body, token): body: a body that is not the contract's JSON; token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 403 Problem (problems: origin, guest-scope): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site; guest-scope: a guest's session: sign in for this
• 404 Problem: no such item
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 422 Problem (problem: menu): menu: the rule is named in detail
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, or with a token the token's, with Retry-After

The answer, MenuEditResponse

curl

curl -X PATCH 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/menu/items/<slug>' \
  -H 'Authorization: Bearer <your token>' \
  -H 'Content-Type: application/json' \
  -d '{}'

Copy the curl for patch-menu-item

POST /v1/sandboxes/{id}/menu/publish

Publish the drafts: `MenuPublished`, the version plus one

A signed-in session of sandbox {id}; a guest gets 403 guest-scope. The sandbox's API token may stand in for the cookie. Carries an Idempotency-Key.

Operation publish-menu · added in PR 4. A signed-in session of this sandbox; a guest gets 403 guest-scope. A token is accepted.

Parameters

Answers

• 200 MenuEditResponse: {version, pending}
• 400 Problem (problems: idempotency-key, token): idempotency-key: no Idempotency-Key, or not a ULID; token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 403 Problem (problems: origin, guest-scope): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site; guest-scope: a guest's session: sign in for this
• 404 Problem: another sandbox's id, or one naming nothing
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 422 Problem (problems: menu, idempotency-key): menu: no drafts to publish; idempotency-key: the same key again with a different body
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, or with a token the token's, with Retry-After

The answer, MenuEditResponse

curl

curl -X POST 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/menu/publish' \
  -H 'Authorization: Bearer <your token>' \
  -H 'Idempotency-Key: <a new ULID>'

Copy the curl for publish-menu

POST /v1/sandboxes/{id}/orders

Place an order as the sandbox's persona; its slot is held until it is paid

A session of sandbox {id}, a guest's included. The sandbox's API token may stand in for the cookie. Carries an Idempotency-Key.

Operation place-order · added in PR 4. A session of this sandbox, a guest’s included. A token is accepted.

Parameters

Request body, OrderRequest

Answers

• 200 OrderResponse: the same Idempotency-Key again: the first answer, replayed
• 201 OrderResponse: the order, with Location
• 400 Problem (problems: idempotency-key, body, token): idempotency-key: no Idempotency-Key, or not a ULID; body: a body that is not the contract's JSON; token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 403 Problem (problem: origin): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site
• 404 Problem: another sandbox's id, or one naming nothing
• 409 Problem (problems: slot-full, item-cap, lead-time, hold-lost): slot-full: with next_free, the next free start that day; item-cap: an item's daily cap is reached; lead-time: naming the hours, such as a 48 h cake for tomorrow; hold-lost: a retry whose place was given back before any order was placed, with no room left; with next_free
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 422 Problem (problems: no-such-slot, closed-day, order, idempotency-key): no-such-slot: not a slot or window start, or a day outside the sandbox's; closed-day: the bakery is closed that day; order: naming the rule (note-<class> for the note); idempotency-key: the same key again with a different body
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, or with a token the token's, with Retry-After
• 503 Problem (problem: seeding): seeding: the sandbox is still being seeded

The answer, OrderResponse

curl

curl -X POST 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/orders' \
  -H 'Authorization: Bearer <your token>' \
  -H 'Idempotency-Key: <a new ULID>' \
  -H 'Content-Type: application/json' \
  -d '{"kind":"pickup","slot":"<string>","lines":[{"variant":"<string>","qty":1}]}'

Copy the curl for place-order

GET /v1/sandboxes/{id}/orders/{oid}

One order, once the Sandbox's registry holds it

A session of sandbox {id}, a guest's included. The sandbox's API token may stand in for the cookie.

Operation get-order · added in PR 4. A session of this sandbox, a guest’s included. A token is accepted.

Parameters

Answers

• 200 OrderResponse: the order
• 400 Problem (problem: token): token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 404 Problem: an id this sandbox has not registered, another's included
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 429 Problem (problem: rate-limit): rate-limit: with a token, the token's limit: every request it makes counts, with Retry-After

The answer, OrderResponse

curl

curl 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/orders/<oid>' \
  -H 'Authorization: Bearer <your token>'

Copy the curl for get-order

POST /v1/sandboxes/{id}/orders/{oid}/cancel

The customer cancels

A session of sandbox {id}, a guest's included. The sandbox's API token may stand in for the cookie. Carries an Idempotency-Key.

Operation cancel-order · added in PR 4. A session of this sandbox, a guest’s included. A token is accepted.

Parameters

Answers

• 200 OrderResponse: the order, cancelled
• 400 Problem (problems: idempotency-key, token): idempotency-key: no Idempotency-Key, or not a ULID; token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 403 Problem (problem: origin): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site
• 404 Problem: an id this sandbox has not registered, another's included
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 422 Problem (problems: order, idempotency-key): order: naming the rule; idempotency-key: the same key again with a different body
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, or with a token the token's, with Retry-After

The answer, OrderResponse

curl

curl -X POST 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/orders/<oid>/cancel' \
  -H 'Authorization: Bearer <your token>' \
  -H 'Idempotency-Key: <a new ULID>'

Copy the curl for cancel-order

POST /v1/sandboxes/{id}/orders/{oid}/payment

What the browser needs to mount Stripe's Payment Element; only the webhook marks it paid

A session of sandbox {id}, a guest's included. The sandbox's API token may stand in for the cookie. Carries an Idempotency-Key.

Operation pay · added in PR 5. A session of this sandbox, a guest’s included. A token is accepted.

Parameters

Answers

• 200 PaymentResponse: the payment and its one-time client_secret
• 400 Problem (problems: idempotency-key, token): idempotency-key: no Idempotency-Key, or not a ULID; token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 403 Problem (problem: origin): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site
• 404 Problem: an unknown order
• 409 Problem (problem: order): order: unless the order is placed
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 422 Problem (problem: idempotency-key): idempotency-key: the same key again with a different body
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, or with a token the token's, with Retry-After
• 503 Problem (problem: stripe-key): stripe-key: the API has no sandbox Stripe key

The answer, PaymentResponse

curl

curl -X POST 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/orders/<oid>/payment' \
  -H 'Authorization: Bearer <your token>' \
  -H 'Idempotency-Key: <a new ULID>'

Copy the curl for pay

POST /v1/sandboxes/{id}/orders/{oid}/refund

Staff refund a part or all that is left; Billing refunds at Stripe from the Queue

A signed-in session of sandbox {id}; a guest gets 403 guest-scope. The sandbox's API token may stand in for the cookie. Carries an Idempotency-Key.

Operation refund · added in PR 5. A signed-in session of this sandbox; a guest gets 403 guest-scope. A token is accepted.

Parameters

Request body, RefundRequest

Answers

• 200 RefundResponse: the refund, on its way to Stripe; the same Idempotency-Key again: the first answer, replayed
• 400 Problem (problems: idempotency-key, body, token): idempotency-key: no Idempotency-Key, or not a ULID; body: a body that is not the contract's JSON; token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 403 Problem (problems: origin, guest-scope): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site; guest-scope: a guest's session: sign in for this
• 404 Problem: another sandbox's id, or one naming nothing
• 409 Problem (problem: order): order: no-stripe-payment: a seeded order Stripe never charged
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 422 Problem (problems: order, idempotency-key): order: refund-exceeds-paid or out-of-order; idempotency-key: the same key again with a different body
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, or with a token the token's, with Retry-After
• 503 Problem (problem: stripe-key): stripe-key: the API has no sandbox Stripe key

The answer, RefundResponse

curl

curl -X POST 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/orders/<oid>/refund' \
  -H 'Authorization: Bearer <your token>' \
  -H 'Idempotency-Key: <a new ULID>' \
  -H 'Content-Type: application/json' \
  -d '{"reason":"missing_item"}'

Copy the curl for refund

POST /v1/sandboxes/{id}/heartbeat

The console is open with no socket: the Kitchen keeps the time for the Simulator

A session of sandbox {id}, a guest's included. The sandbox's API token may stand in for the cookie. Carries an Idempotency-Key.

Operation heartbeat · added in PR 4. A session of this sandbox, a guest’s included. A token is accepted.

Parameters

Answers

• 204: noted
• 400 Problem (problems: idempotency-key, token): idempotency-key: no Idempotency-Key, or not a ULID; token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 403 Problem (problem: origin): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site
• 404 Problem: another sandbox's id
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 422 Problem (problem: idempotency-key): idempotency-key: the same key again with a different body
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, or with a token the token's, with Retry-After

curl

curl -X POST 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/heartbeat' \
  -H 'Authorization: Bearer <your token>' \
  -H 'Idempotency-Key: <a new ULID>'

Copy the curl for heartbeat

GET /v1/sandboxes/{id}/kitchen/ws

The kitchen board's socket, protocol v1 (`x-websocket`)

A session of sandbox {id}, by the cookie only, with the storefront's exact Origin.

Operation kitchen-socket · added in PR 4. The session cookie only. No token: the cookie or nothing.

Parameters

Answers

• 101: the socket; frames in x-websocket
• 400 Problem (problem: token): token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: an API token: this route takes the session cookie only (cookie-only); session: no session, or one that does not verify
• 403 Problem (problem: origin): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site
• 404 Problem: another sandbox's id
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 426 Problem (problem: upgrade): upgrade: without Upgrade: websocket
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, with Retry-After
• 503 Problem (problem: seeding): seeding: the sandbox is still being seeded

A WebSocket takes the console’s cookie only; see the kitchen socket below.

DELETE /v1/sandboxes/{id}/traffic

Stop simulated orders; the unused minutes go back to Control

A signed-in session of sandbox {id}; a guest gets 403 guest-scope. The sandbox's API token may stand in for the cookie.

Operation stop-traffic · added in PR 4. A signed-in session of this sandbox; a guest gets 403 guest-scope. A token is accepted.

Parameters

Answers

• 200 TrafficResponse: the Simulator, stopped
• 400 Problem (problem: token): token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 403 Problem (problems: origin, guest-scope): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site; guest-scope: a guest's session: sign in for this
• 404 Problem: another sandbox's id, or one naming nothing
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, or with a token the token's, with Retry-After

The answer, TrafficResponse

curl

curl -X DELETE 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/traffic' \
  -H 'Authorization: Bearer <your token>'

Copy the curl for stop-traffic

GET /v1/sandboxes/{id}/traffic

The Simulator's state, today's

A session of sandbox {id}, a guest's included. The sandbox's API token may stand in for the cookie.

Operation get-traffic · added in PR 4. A session of this sandbox, a guest’s included. A token is accepted.

Parameters

Answers

• 200 TrafficResponse: {running, rate, minutes_used, minutes_left, orders}
• 400 Problem (problem: token): token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 404 Problem: another sandbox's id, or one naming nothing
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 429 Problem (problem: rate-limit): rate-limit: with a token, the token's limit: every request it makes counts, with Retry-After

The answer, TrafficResponse

curl

curl 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/traffic' \
  -H 'Authorization: Bearer <your token>'

Copy the curl for get-traffic

POST /v1/sandboxes/{id}/traffic

Start simulated orders, 1 to 6 a minute, within today's 30 minutes

A signed-in session of sandbox {id}; a guest gets 403 guest-scope. The sandbox's API token may stand in for the cookie. Carries an Idempotency-Key.

Operation start-traffic · added in PR 4. A signed-in session of this sandbox; a guest gets 403 guest-scope. A token is accepted.

Parameters

Request body, TrafficRequest

Answers

• 200 TrafficResponse: the Simulator, running; the same Idempotency-Key again: the first answer, replayed
• 400 Problem (problems: idempotency-key, body, token): idempotency-key: no Idempotency-Key, or not a ULID; body: a body that is not the contract's JSON; token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 403 Problem (problems: origin, guest-scope): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site; guest-scope: a guest's session: sign in for this
• 404 Problem: another sandbox's id, or one naming nothing
• 409 Problem (problem: traffic-running): traffic-running: a run is already going
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 422 Problem (problems: traffic, idempotency-key): traffic: naming the rule; idempotency-key: the same key again with a different body
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, or with a token the token's, with Retry-After
• 503 Problem (problem: traffic-cap): traffic-cap: today's minutes are used; with Retry-After

The answer, TrafficResponse

curl

curl -X POST 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/traffic' \
  -H 'Authorization: Bearer <your token>' \
  -H 'Idempotency-Key: <a new ULID>' \
  -H 'Content-Type: application/json' \
  -d '{"rate":1}'

Copy the curl for start-traffic

GET /v1/sandboxes/{id}/billing/ledger

Every payment and refund Billing recorded, and the totals

A session of sandbox {id}, a guest's included. The sandbox's API token may stand in for the cookie.

Operation ledger · added in PR 5. A session of this sandbox, a guest’s included. A token is accepted.

Parameters

Answers

• 200 LedgerResponse: the ledger
• 400 Problem (problem: token): token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 404 Problem: another sandbox's id, or one naming nothing
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 429 Problem (problem: rate-limit): rate-limit: with a token, the token's limit: every request it makes counts, with Retry-After
• 503 Problem (problem: stripe-key): stripe-key: the API has no sandbox Stripe key

The answer, LedgerResponse

curl

curl 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/billing/ledger' \
  -H 'Authorization: Bearer <your token>'

Copy the curl for ledger

POST /v1/stripe/webhook

Stripe's events, checked against `Stripe-Signature`, test mode only; no CORS, Origin, session, key or rate limit

Stripe only: its signature is the check.

Operation stripe-webhook · added in PR 5. Stripe only, by its signature. No token: the cookie or nothing.

Answers

• 200: an event applied, replayed or ignored, and for a wiped or unknown sandbox
• 400 Problem (problems: signature, timestamp, body, livemode): signature: the signature does not verify; timestamp: the signature's timestamp is outside the tolerance; body: not a Stripe event; livemode: a live-mode event
• 405 Problem: OPTIONS, with Allow: POST: no preflight
• 409 Problem (problem: webhook-later): webhook-later: an event Billing cannot apply yet
• 503 Problem (problem: stripe-key): stripe-key: the API has no sandbox Stripe key

This route takes the console’s cookie only, so a token cannot call it: a token never mints its successor, and a browser session is the only way to sign in.

GET /v1/sandboxes/{id}/schedule/{date}

One bakery day: slots, zones, item caps, catering and the bake list

A session of sandbox {id}, a guest's included. The sandbox's API token may stand in for the cookie.

Operation get-schedule · added in PR 6. A session of this sandbox, a guest’s included. A token is accepted.

Parameters

Answers

• 200 ScheduleResponse: the day
• 400 Problem (problem: token): token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 404 Problem (problem: no-such-day): no-such-day: a date outside the sandbox's days
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 429 Problem (problem: rate-limit): rate-limit: with a token, the token's limit: every request it makes counts, with Retry-After
• 503 Problem (problem: seeding): seeding: the sandbox is still being seeded

The answer, ScheduleResponse

curl

curl 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/schedule/<date>' \
  -H 'Authorization: Bearer <your token>'

Copy the curl for get-schedule

PATCH /v1/sandboxes/{id}/schedule/{date}/capacity

Set one capacity for the day; places already taken stay

A signed-in session of sandbox {id}; a guest gets 403 guest-scope. The sandbox's API token may stand in for the cookie.

Operation set-capacity · added in PR 6. A signed-in session of this sandbox; a guest gets 403 guest-scope. A token is accepted.

Parameters

Request body, CapacityRequest

Answers

• 200 ScheduleResponse: the day
• 400 Problem (problems: body, token): body: a body that is not the contract's JSON; token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 403 Problem (problems: origin, guest-scope): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site; guest-scope: a guest's session: sign in for this
• 404 Problem (problem: no-such-day): no-such-day: a date outside the sandbox's days
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 422 Problem (problems: bad-target, unknown-item): bad-target: not slot:HH:MM, zone:z1 to z3, item:<slug> or catering; unknown-item: an item:<slug> the day's published menu does not list
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, or with a token the token's, with Retry-After

The answer, ScheduleResponse

curl

curl -X PATCH 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/schedule/<date>/capacity' \
  -H 'Authorization: Bearer <your token>' \
  -H 'Content-Type: application/json' \
  -d '{"target":"<string>","capacity":1}'

Copy the curl for set-capacity

GET /v1/sandboxes/{id}/catering

Every registered catering event, newest inquiry first

A session of sandbox {id}, a guest's included. The sandbox's API token may stand in for the cookie.

Operation list-catering · added in PR 7. A session of this sandbox, a guest’s included. A token is accepted.

Parameters

Answers

• 200 CateringListResponse: the events, the seeded eight included
• 400 Problem (problem: token): token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 404 Problem: another sandbox's id, or one naming nothing
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 429 Problem (problem: rate-limit): rate-limit: with a token, the token's limit: every request it makes counts, with Retry-After

The answer, CateringListResponse

curl

curl 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/catering' \
  -H 'Authorization: Bearer <your token>'

Copy the curl for list-catering

POST /v1/sandboxes/{id}/catering

A catering inquiry, as the sandbox's persona

A session of sandbox {id}, a guest's included. The sandbox's API token may stand in for the cookie. Carries an Idempotency-Key.

Operation create-catering · added in PR 7. A session of this sandbox, a guest’s included. A token is accepted.

Parameters

Request body, CateringInquiryRequest

Answers

• 200 CateringResponse: the same Idempotency-Key again: the first answer, replayed
• 201 CateringResponse: the inquiry, with Location
• 400 Problem (problems: idempotency-key, body, token): idempotency-key: no Idempotency-Key, or not a ULID; body: a body that is not the contract's JSON; token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 403 Problem (problem: origin): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site
• 404 Problem: another sandbox's id, or one naming nothing
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 422 Problem (problems: catering, idempotency-key): catering: detail ends The rule is <slug>.; never echoes the brief; idempotency-key: the same key again with a different body
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, or with a token the token's, with Retry-After

The answer, CateringResponse

curl

curl -X POST 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/catering' \
  -H 'Authorization: Bearer <your token>' \
  -H 'Idempotency-Key: <a new ULID>' \
  -H 'Content-Type: application/json' \
  -d '{"date":"<string>","headcount":1,"package":"<string>","venue":"<string>"}'

Copy the curl for create-catering

GET /v1/sandboxes/{id}/catering/{cid}

One catering event, with the reminders still to come

A session of sandbox {id}, a guest's included. The sandbox's API token may stand in for the cookie.

Operation get-catering · added in PR 7. A session of this sandbox, a guest’s included. A token is accepted.

Parameters

Answers

• 200 CateringResponse: the event
• 400 Problem (problem: token): token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 404 Problem: an id this sandbox has not registered, another's included
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 429 Problem (problem: rate-limit): rate-limit: with a token, the token's limit: every request it makes counts, with Retry-After

The answer, CateringResponse

curl

curl 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/catering/<cid>' \
  -H 'Authorization: Bearer <your token>'

Copy the curl for get-catering

POST /v1/sandboxes/{id}/catering/{cid}/accept

Accept the quote: the day's catering place is held while the deposit is paid

A session of sandbox {id}, a guest's included. The sandbox's API token may stand in for the cookie. Carries an Idempotency-Key.

Operation accept-quote · added in PR 7. A session of this sandbox, a guest’s included. A token is accepted.

Parameters

Answers

• 200 CateringResponse: accepted
• 400 Problem (problems: idempotency-key, token): idempotency-key: no Idempotency-Key, or not a ULID; token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 403 Problem (problem: origin): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site
• 404 Problem: another sandbox's id, or one naming nothing
• 409 Problem (problems: slot-full, catering): slot-full: both of the day's catering places are taken; nothing recorded; catering: out-of-order or quote-expired
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 422 Problem (problem: idempotency-key): idempotency-key: the same key again with a different body
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, or with a token the token's, with Retry-After

The answer, CateringResponse

curl

curl -X POST 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/catering/<cid>/accept' \
  -H 'Authorization: Bearer <your token>' \
  -H 'Idempotency-Key: <a new ULID>'

Copy the curl for accept-quote

POST /v1/sandboxes/{id}/catering/{cid}/cancel

The customer cancels a confirmed event; more than 7 days out the deposit is refunded

A session of sandbox {id}, a guest's included. The sandbox's API token may stand in for the cookie. Carries an Idempotency-Key.

Operation cancel-catering · added in PR 7. A session of this sandbox, a guest’s included. A token is accepted.

Parameters

Request body, CateringCancelRequest

Answers

• 200 CateringResponse: cancelled, with refund_deposit
• 400 Problem (problems: idempotency-key, body, token): idempotency-key: no Idempotency-Key, or not a ULID; body: a body that is not the contract's JSON; token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 403 Problem (problem: origin): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site
• 404 Problem: another sandbox's id, or one naming nothing
• 409 Problem (problem: catering): catering: out-of-order
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 422 Problem (problem: idempotency-key): idempotency-key: the same key again with a different body
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, or with a token the token's, with Retry-After

The answer, CateringResponse

curl

curl -X POST 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/catering/<cid>/cancel' \
  -H 'Authorization: Bearer <your token>' \
  -H 'Idempotency-Key: <a new ULID>' \
  -H 'Content-Type: application/json' \
  -d '{"reason":"customer_change"}'

Copy the curl for cancel-catering

POST /v1/sandboxes/{id}/catering/{cid}/decline

Staff decline an inquiry

A signed-in session of sandbox {id}; a guest gets 403 guest-scope. The sandbox's API token may stand in for the cookie. Carries an Idempotency-Key.

Operation decline-catering · added in PR 7. A signed-in session of this sandbox; a guest gets 403 guest-scope. A token is accepted.

Parameters

Request body, DeclineRequest

Answers

• 200 CateringResponse: declined
• 400 Problem (problems: idempotency-key, body, token): idempotency-key: no Idempotency-Key, or not a ULID; body: a body that is not the contract's JSON; token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 403 Problem (problems: origin, guest-scope): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site; guest-scope: a guest's session: sign in for this
• 404 Problem: another sandbox's id, or one naming nothing
• 409 Problem (problem: catering): catering: past inquiry
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 422 Problem (problem: idempotency-key): idempotency-key: the same key again with a different body
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, or with a token the token's, with Retry-After

The answer, CateringResponse

curl

curl -X POST 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/catering/<cid>/decline' \
  -H 'Authorization: Bearer <your token>' \
  -H 'Idempotency-Key: <a new ULID>' \
  -H 'Content-Type: application/json' \
  -d '{"reason":"too_soon"}'

Copy the curl for decline-catering

POST /v1/sandboxes/{id}/catering/{cid}/delivered

Staff mark it delivered; Billing raises the balance invoice

A signed-in session of sandbox {id}; a guest gets 403 guest-scope. The sandbox's API token may stand in for the cookie. Carries an Idempotency-Key.

Operation mark-catering-delivered · added in PR 7. A signed-in session of this sandbox; a guest gets 403 guest-scope. A token is accepted.

Parameters

Answers

• 200 CateringResponse: delivered; poll for invoice
• 400 Problem (problems: idempotency-key, token): idempotency-key: no Idempotency-Key, or not a ULID; token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 403 Problem (problems: origin, guest-scope): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site; guest-scope: a guest's session: sign in for this
• 404 Problem: another sandbox's id, or one naming nothing
• 409 Problem (problem: catering): catering: out-of-order; too-early before the event day
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 422 Problem (problem: idempotency-key): idempotency-key: the same key again with a different body
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, or with a token the token's, with Retry-After

The answer, CateringResponse

curl

curl -X POST 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/catering/<cid>/delivered' \
  -H 'Authorization: Bearer <your token>' \
  -H 'Idempotency-Key: <a new ULID>'

Copy the curl for mark-catering-delivered

POST /v1/sandboxes/{id}/catering/{cid}/deposit

The deposit's payment, 25% of the quote, as an order's `/payment`

A session of sandbox {id}, a guest's included. The sandbox's API token may stand in for the cookie. Carries an Idempotency-Key.

Operation catering-deposit · added in PR 7. A session of this sandbox, a guest’s included. A token is accepted.

Parameters

Answers

• 200 PaymentResponse: the payment and its one-time client_secret
• 400 Problem (problems: idempotency-key, token): idempotency-key: no Idempotency-Key, or not a ULID; token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 403 Problem (problem: origin): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site
• 404 Problem: another sandbox's id, or one naming nothing
• 409 Problem (problem: catering): catering: unless accepted
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 422 Problem (problem: idempotency-key): idempotency-key: the same key again with a different body
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, or with a token the token's, with Retry-After
• 503 Problem (problem: stripe-key): stripe-key: the API has no sandbox Stripe key

The answer, PaymentResponse

curl

curl -X POST 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/catering/<cid>/deposit' \
  -H 'Authorization: Bearer <your token>' \
  -H 'Idempotency-Key: <a new ULID>'

Copy the curl for catering-deposit

POST /v1/sandboxes/{id}/catering/{cid}/pay-balance

Pay the balance invoice on Stripe's test path; the webhook closes the event

A session of sandbox {id}, a guest's included. The sandbox's API token may stand in for the cookie. Carries an Idempotency-Key.

Operation pay-balance · added in PR 7. A session of this sandbox, a guest’s included. A token is accepted.

Parameters

Answers

• 202 CateringResponse: the event as it stands: poll until closed
• 400 Problem (problems: idempotency-key, token): idempotency-key: no Idempotency-Key, or not a ULID; token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 403 Problem (problem: origin): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site
• 404 Problem: another sandbox's id, or one naming nothing
• 409 Problem (problem: catering): catering: unless invoiced
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 422 Problem (problem: idempotency-key): idempotency-key: the same key again with a different body
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, or with a token the token's, with Retry-After

The answer, CateringResponse

curl

curl -X POST 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/catering/<cid>/pay-balance' \
  -H 'Authorization: Bearer <your token>' \
  -H 'Idempotency-Key: <a new ULID>'

Copy the curl for pay-balance

POST /v1/sandboxes/{id}/catering/{cid}/quote

Staff quote an inquiry

A signed-in session of sandbox {id}; a guest gets 403 guest-scope. The sandbox's API token may stand in for the cookie. Carries an Idempotency-Key.

Operation send-quote · added in PR 7. A signed-in session of this sandbox; a guest gets 403 guest-scope. A token is accepted.

Parameters

Request body, QuoteRequest

Answers

• 200 CateringResponse: quoted
• 400 Problem (problems: idempotency-key, body, token): idempotency-key: no Idempotency-Key, or not a ULID; body: a body that is not the contract's JSON; token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 403 Problem (problems: origin, guest-scope): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site; guest-scope: a guest's session: sign in for this
• 404 Problem: another sandbox's id, or one naming nothing
• 409 Problem (problem: catering): catering: out-of-order, or quote-expired once the day before the event has begun
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 422 Problem (problems: catering, idempotency-key): catering: quote-total, a total under 1 cent; idempotency-key: the same key again with a different body
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, or with a token the token's, with Retry-After

The answer, CateringResponse

curl

curl -X POST 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/catering/<cid>/quote' \
  -H 'Authorization: Bearer <your token>' \
  -H 'Idempotency-Key: <a new ULID>' \
  -H 'Content-Type: application/json' \
  -d '{}'

Copy the curl for send-quote

POST /v1/sandboxes/{id}/catering/{cid}/staff-cancel

Staff cancel a confirmed event

A signed-in session of sandbox {id}; a guest gets 403 guest-scope. The sandbox's API token may stand in for the cookie. Carries an Idempotency-Key.

Operation staff-cancel-catering · added in PR 7. A signed-in session of this sandbox; a guest gets 403 guest-scope. A token is accepted.

Parameters

Request body, CateringCancelRequest

Answers

• 200 CateringResponse: cancelled
• 400 Problem (problems: idempotency-key, body, token): idempotency-key: no Idempotency-Key, or not a ULID; body: a body that is not the contract's JSON; token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 403 Problem (problems: origin, guest-scope): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site; guest-scope: a guest's session: sign in for this
• 404 Problem: another sandbox's id, or one naming nothing
• 409 Problem (problem: catering): catering: out of order
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 422 Problem (problem: idempotency-key): idempotency-key: the same key again with a different body
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, or with a token the token's, with Retry-After

The answer, CateringResponse

curl

curl -X POST 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/catering/<cid>/staff-cancel' \
  -H 'Authorization: Bearer <your token>' \
  -H 'Idempotency-Key: <a new ULID>' \
  -H 'Content-Type: application/json' \
  -d '{"reason":"customer_change"}'

Copy the curl for staff-cancel-catering

POST /v1/sandboxes/{id}/catering/{cid}/start-production

Staff start production of a confirmed event

A signed-in session of sandbox {id}; a guest gets 403 guest-scope. The sandbox's API token may stand in for the cookie. Carries an Idempotency-Key.

Operation start-catering-production · added in PR 7. A signed-in session of this sandbox; a guest gets 403 guest-scope. A token is accepted.

Parameters

Answers

• 200 CateringResponse: in_production
• 400 Problem (problems: idempotency-key, token): idempotency-key: no Idempotency-Key, or not a ULID; token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 403 Problem (problems: origin, guest-scope): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site; guest-scope: a guest's session: sign in for this
• 404 Problem: another sandbox's id, or one naming nothing
• 409 Problem (problem: catering): catering: out-of-order unless confirmed; too-early before the day before the event
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 422 Problem (problem: idempotency-key): idempotency-key: the same key again with a different body
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, or with a token the token's, with Retry-After

The answer, CateringResponse

curl

curl -X POST 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/catering/<cid>/start-production' \
  -H 'Authorization: Bearer <your token>' \
  -H 'Idempotency-Key: <a new ULID>'

Copy the curl for start-catering-production

GET /v1/sandboxes/{id}/activity

The sandbox's logged events, newest first

A session of sandbox {id}, a guest's included. The sandbox's API token may stand in for the cookie.

Operation get-activity · added in PR 8. A session of this sandbox, a guest’s included. A token is accepted.

Parameters

Answers

• 200 ActivityResponse: the activity feed
• 400 Problem (problem: token): token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 404 Problem: another sandbox's id, or one naming nothing
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 429 Problem (problem: rate-limit): rate-limit: with a token, the token's limit: every request it makes counts, with Retry-After

The answer, ActivityResponse

curl

curl 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/activity' \
  -H 'Authorization: Bearer <your token>'

Copy the curl for get-activity

GET /v1/sandboxes/{id}/campaigns

Every campaign, by id

A session of sandbox {id}, a guest's included. The sandbox's API token may stand in for the cookie.

Operation list-campaigns · added in PR 8. A session of this sandbox, a guest’s included. A token is accepted.

Parameters

Answers

• 200 CampaignListResponse: the campaigns
• 400 Problem (problem: token): token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 404 Problem: another sandbox's id, or one naming nothing
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 429 Problem (problem: rate-limit): rate-limit: with a token, the token's limit: every request it makes counts, with Retry-After

The answer, CampaignListResponse

curl

curl 'https://api.bakery.ihaveasegway.com/v1/sandboxes/<sandbox id>/campaigns' \
  -H 'Authorization: Bearer <your token>'

Copy the curl for list-campaigns

POST /v1/sandboxes/{id}/campaigns

A draft campaign, from the fixed templates

A signed-in session of sandbox {id}; a guest gets 403 guest-scope. The sandbox's API token may stand in for the cookie. Carries an Idempotency-Key.

Operation create-campaign · added in PR 8. A signed-in session of this sandbox; a guest gets 403 guest-scope. A token is accepted.

Parameters

Request body, CampaignRequest

Answers

• 200 CampaignResponse: the same Idempotency-Key again: the first answer, replayed
• 201 CampaignResponse: the draft, with Location
• 400 Problem (problems: idempotency-key, body, token): idempotency-key: no Idempotency-Key, or not a ULID; body: a body that is not the contract's JSON; token: a cookie and a token both (both), or a token in the query string (query)
• 401 Problem (problems: token, session): token: a token that is malformed, expired, rotated or not an API token (token, expired, rotated, purpose); session: no session, or one that does not verify
• 403 Problem (problems: origin, guest-scope): origin: a cookie request without the storefront's exact Origin, or Sec-Fetch-Site: cross-site; guest-scope: a guest's session: sign in for this
• 404 Problem: another sandbox's id, or one naming nothing
• 410 Problem (problem: wiped): wiped: the sandbox is being wiped or is gone
• 422 Problem (problem: idempotency-key): idempotency-key: the same key again with a different body
• 429 Problem (problem: rate-limit): rate-limit: the session's or IP hash's limit, or with a token the token's, with Retry-After