API Routes

All server-side API endpoints and their purposes

API Routes

HostMetrics has 16 API routes organized by feature domain. Most data operations happen client-side via Supabase JS; API routes are used for server-side operations only.

Route Reference

Turo Integration

Method	Path	Auth	Purpose
POST	/api/turo/sync	Bearer token	Receive CSV data from Chrome extension, parse, and import into database

Toll Management

Method	Path	Auth	Purpose
POST	/api/tolls/sync	Bearer token	Trigger server-side toll scraping for connected accounts
POST	/api/tolls/test-connection	Bearer token	Test toll account credentials without importing data

Stripe Billing

Method	Path	Auth	Purpose
POST	/api/stripe/create-checkout	Session	Create Stripe Checkout session for new subscription
POST	/api/stripe/portal	Session	Redirect to Stripe Customer Portal for managing subscription
POST	/api/stripe/webhook	Stripe signature	Process Stripe events (subscription changes, payments)

Integrations

Method	Path	Auth	Purpose
POST	/api/integrations/bouncie/connect	Session	OAuth connect to Bouncie GPS tracking
POST	/api/integrations/bouncie/sync	Session	Sync vehicle data from Bouncie
POST	/api/integrations/plaid/create-link-token	Session	Create Plaid Link token for bank connection
POST	/api/integrations/plaid/exchange-token	Session	Exchange Plaid public token for access token
POST	/api/integrations/quickbooks/authorize	Session	Start QuickBooks OAuth flow
POST	/api/integrations/quickbooks/callback	Session	Handle QuickBooks OAuth callback

Public / Shared

Method	Path	Auth	Purpose
GET	/api/fleet/[slug]	None	Fetch public fleet page data by slug
GET	/api/portal/[token]	Token	Investor portal access (token in URL)
GET	/api/r/[token]	Token	Investor report access (token in URL)
GET	/api/investors/[id]/reports	Session	Generate investor financial reports

Webhook Events (Stripe)

The /api/stripe/webhook endpoint processes these Stripe events:

Event	Action
checkout.session.completed	Create subscription record in database
customer.subscription.updated	Sync plan and status changes
customer.subscription.deleted	Mark subscription as cancelled
invoice.paid	Record payment, create invoice record
invoice.payment_failed	Log failure, update subscription status

Authentication Patterns

Bearer Token — Used by Chrome extension and toll sync. Token is the Supabase access_token:

Authorization: Bearer eyJhbGciOiJIUzI1NiIs...

Session — Used by browser-initiated API calls. Supabase session cookie is automatically included.

Stripe Signature — Webhook validates using stripe.webhooks.constructEvent() with the signing secret.

Token in URL — Investor portal/report links use a unique token in the URL path for access control.