Endpoints Overview
GET /api/sessions
Query scheduled personal training sessions. Supports optional query parameters: category, day, limit, offset.
GET /api/sessions?id={sessionId}
Retrieve specific session details, remaining capacity, pricing, and coach information.
GET /api/bookings
List the authenticated client's active and upcoming bookings. Requires user session cookie or Bearer token.
POST /api/bookings
Book a spot in an available session. Body: { "sessionId": "UUID" }. Requires user session cookie or Bearer token.
POST /api/chat
Customer Support AI Agent. Dual-layer conversation endpoint: guest schedule browsing & FAQ answers; authenticated client booking actions.
POST /mcp
Model Context Protocol (MCP) JSON-RPC 2.0 endpoint supporting methods: initialize, tools/list, tools/call.
GET /mcp
Returns the full MCP server tool manifest and capabilities. Supports Accept: text/event-stream for Streamable HTTP / Server-Sent Events (SSE).
Admin & Scoped Data API (/api/v1/*)
Requires a General-Purpose API Key generated from Admin Settings (Authorization: Bearer sbp_...).
Enforces 29 granular read, write, and delete permissions across 10 categories.
/api/v1/users
CRUD operations for all user accounts and profile roles. Scopes: users:read, users:write, users:delete.
/api/v1/login-history
Audit authentication logs, IP addresses, and user-agents. Scopes: login_history:read, login_history:delete.
/api/v1/clients
Customer client directory (strictly excludes admin/team). Scopes: clients:read, clients:write, clients:delete.
/api/v1/session-types
Session types, pricing, capacity, and categories. Scopes: session_types:read, session_types:write, session_types:delete.
/api/v1/categories
Session workout categories. Scopes: categories:read, categories:write, categories:delete.
/api/v1/sessions
Administrative schedule management. Scopes: sessions:read, sessions:write, sessions:delete.
/api/v1/bookings
Administrative bookings inspection and updates. Scopes: bookings:read, bookings:write, bookings:delete.
/api/v1/refund-requests
Refund requests lifecycle and review. Scopes: refund_requests:read, refund_requests:write, refund_requests:delete.