> ## Documentation Index
> Fetch the complete documentation index at: https://dhanurgo.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# API Routes

> All server-side API endpoints and their purposes

# API Routes

HostMetrics has 16 API routes organized by feature domain. Most data operations happen client-side via Supabase JS; API routes are used for server-side operations only.

## Route Reference

### Turo Integration

| Method | Path             | Auth         | Purpose                                                                 |
| ------ | ---------------- | ------------ | ----------------------------------------------------------------------- |
| POST   | `/api/turo/sync` | Bearer token | Receive CSV data from Chrome extension, parse, and import into database |

### Toll Management

| Method | Path                         | Auth         | Purpose                                                  |
| ------ | ---------------------------- | ------------ | -------------------------------------------------------- |
| POST   | `/api/tolls/sync`            | Bearer token | Trigger server-side toll scraping for connected accounts |
| POST   | `/api/tolls/test-connection` | Bearer token | Test toll account credentials without importing data     |

### Stripe Billing

| Method | Path                          | Auth             | Purpose                                                      |
| ------ | ----------------------------- | ---------------- | ------------------------------------------------------------ |
| POST   | `/api/stripe/create-checkout` | Session          | Create Stripe Checkout session for new subscription          |
| POST   | `/api/stripe/portal`          | Session          | Redirect to Stripe Customer Portal for managing subscription |
| POST   | `/api/stripe/webhook`         | Stripe signature | Process Stripe events (subscription changes, payments)       |

### Integrations

| Method | Path                                        | Auth    | Purpose                                      |
| ------ | ------------------------------------------- | ------- | -------------------------------------------- |
| POST   | `/api/integrations/bouncie/connect`         | Session | OAuth connect to Bouncie GPS tracking        |
| POST   | `/api/integrations/bouncie/sync`            | Session | Sync vehicle data from Bouncie               |
| POST   | `/api/integrations/plaid/create-link-token` | Session | Create Plaid Link token for bank connection  |
| POST   | `/api/integrations/plaid/exchange-token`    | Session | Exchange Plaid public token for access token |
| POST   | `/api/integrations/quickbooks/authorize`    | Session | Start QuickBooks OAuth flow                  |
| POST   | `/api/integrations/quickbooks/callback`     | Session | Handle QuickBooks OAuth callback             |

### Public / Shared

| Method | Path                          | Auth    | Purpose                               |
| ------ | ----------------------------- | ------- | ------------------------------------- |
| GET    | `/api/fleet/[slug]`           | None    | Fetch public fleet page data by slug  |
| GET    | `/api/portal/[token]`         | Token   | Investor portal access (token in URL) |
| GET    | `/api/r/[token]`              | Token   | Investor report access (token in URL) |
| GET    | `/api/investors/[id]/reports` | Session | Generate investor financial reports   |

## Webhook Events (Stripe)

The `/api/stripe/webhook` endpoint processes these Stripe events:

| Event                           | Action                                  |
| ------------------------------- | --------------------------------------- |
| `checkout.session.completed`    | Create subscription record in database  |
| `customer.subscription.updated` | Sync plan and status changes            |
| `customer.subscription.deleted` | Mark subscription as cancelled          |
| `invoice.paid`                  | Record payment, create invoice record   |
| `invoice.payment_failed`        | Log failure, update subscription status |

## Authentication Patterns

**Bearer Token** — Used by Chrome extension and toll sync. Token is the Supabase `access_token`:

```
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...
```

**Session** — Used by browser-initiated API calls. Supabase session cookie is automatically included.

**Stripe Signature** — Webhook validates using `stripe.webhooks.constructEvent()` with the signing secret.

**Token in URL** — Investor portal/report links use a unique token in the URL path for access control.