API reference (index)
Everything is under /rest/ except Django admin and the unsubscribe page. Auth is a Bearer JWT unless marked public. Staff endpoints need a staff user and, in deployed environments, a Cloudflare Access JWT (see Authentication).
Routes are declared in EMAW_BACKEND/urls.py and each app's urls.py / staff_urls.py. Staff prefixes are registered before their public counterparts because the public routes end in slug catch-alls.
Core app API (EMAW)
| Prefix | Purpose |
|---|---|
rest/api/token/, …/refresh/, …/logout/, rest/validate/token/ | Login, refresh, logout, token check |
rest/signup/, rest/verify-code/, rest/resend-verification/, rest/change-unverified-email/ | Account creation and verification (public) |
rest/request-password-reset/, rest/confirm-password-reset/, rest/change-password/ | Passwords |
rest/auth/google/, rest/auth/google/link/, rest/auth/identities/ | Google sign-in, link, list |
rest/auth/app-handoff/, rest/auth/app-handoff/exchange/ | Website → app hand-off |
rest/account/me|orders|registrations|donations/ | Website account history |
rest/qt/submitQT/, rest/qt/fetchQT/, rest/qt/updateQT/<id>/, rest/qt/deleteQT/<id>/, rest/fetch-quiet-time-entry/<id>/, rest/delete-all-quiet-times/ | Quiet-time journal |
rest/submit-discussion-questions/, rest/get-submission-dates/<book>/<week>/, rest/get-answers/<book>/<week>/, rest/get-user-progress/<book>/, rest/reset-user-progress/<book>/ | Book questions and progress |
rest/get-user-verses/, rest/add-memory-verse/, rest/mark-verse-memorized/, rest/fetch-verses/, rest/remove-verse/<id>/, rest/verse-finder/ | Memory verses |
rest/get-user-collections/, rest/create-collection/, rest/manage-verse-in-collection/, rest/delete-collection/<id>/, rest/get-collection-verse-count/ | Collections |
rest/generate-audio-file/, rest/analyze-verse-audio/ | TTS and recitation scoring |
rest/get-bible-versions/, rest/get-version-schema/ | Legacy Bible metadata |
rest/user-stats/, rest/delete-user/, rest/contact/ | Stats, account deletion, website contact form (public, origin-checked) |
rest/b4r8x2/… | Obscured analytics endpoints |
Commerce
| Prefix | App | Public | Staff |
|---|---|---|---|
rest/store/ | store | products/, products/<slug>/, checkout/, checkout/<uuid>/shipping-options/, orders/<uuid>/ | rest/store/staff/: orders/ (+ counts/, export.csv, <id>/resubmit/, <id>/refresh/), warehouse-orders/<id>/, inventory/ (+ refresh/, <sku>/history/), analytics/summary|sales|shipping/ |
rest/events/ | events | "" (list), <slug>/, <slug>/register/, registrations/<uuid>/ | rest/events/staff/: events/ ViewSet with actions (publish, open/close registration, archive, duplicate, image, ticket-types, registrations, attendees, meeting sync, leader email, meet attendance), registrations/<id>/ (+ resend-confirmation/), events/<id>/registrations/export.csv, ticket-types/<id>/, guests/<id>/check-in|undo-check-in/, meet-participants/<id>/, google/, google/connect/, google/callback/ |
rest/donations/ | donations | funds/, checkout/, <uuid>/, <uuid>/portal/ | none yet |
rest/stripe/webhook/ | payments | Stripe only (signature-verified) |
Contracts: store/README.md, events/README.md, donations/README.md, payments/README.md.
Bible, notes, AI
| Prefix | App | Endpoints |
|---|---|---|
rest/bibles/ | bibles, bible_search | manifest/, compare/, <version>/search/ (keyword), <version>/<book_id>/<chapter>/, <translation>/<build>/download; with AI_SEARCH_ENABLED: search/ and similar/ (POST, semantic) |
rest/notes/ | notes | highlights/ (+ clear/, <id>/), notes/ (+ <id>/), tags/ (+ apply/, remove/, verses-in-chapter/, <tag_id>/verses/, <id>/) |
rest/ai/ | ai | find-verse/ (POST, AIThrottle) |
Staff surface
| Prefix | App | Endpoints |
|---|---|---|
rest/crm/ | crm | Routers contacts, groups, tags, roles, regions, areas, activities, notes, note-categories, saved-shapes; plus me/, access/capabilities/, contacts/bulk-assign/, contacts/assign-geography/ (+ runs/, runs/<uuid>/), contacts/geo-points/, contacts/geo-sales/, geo/resolve/, geo/preview/; per-contact actions deactivate, reactivate, unsubscribe, resubscribe, link-user, location, geocode, assign-geography |
rest/campaigns/ | campaigns | Routers templates (actions duplicate, preview, send-test, preview-draft/, upload-image/, images/<id>/, ai-drafts/, variables/) and campaigns (actions preview, return-to-draft, prepare, send-test, send, schedule, cancel, duplicate, report, audience, recipients/export.csv); audience/preview/, audience/contacts/; acs-events/?key= (Event Grid webhook) |
rest/resources/ | resources | public "", <slug>/; staff rest/resources/staff/resources/ ViewSet (+ publish, unpublish, cover-image, cover-library/, upload-url/) |
/unsubscribe/<token>/ | campaigns | public, outside /rest/ |
The complete request/response contract for the Admin CRM, including conventions (pagination, errors, X-Request-ID), is docs/CRM_FRONTEND_GUIDE.md (sections 3 to 16). Keep it updated when you change a staff endpoint.
Conventions
- Trailing slashes on every path.
- JSON in and out; production uses a JSON-only renderer.
- Pagination on list endpoints:
?page=; the CRM contact list is cached in Redis per scope and query. - Errors: DRF-style bodies;
X-Request-IDon every response. - CORS origins are allow-listed per surface (
APP_*,COMMERCE_*,CONTACT_FORM_*).