# Employee API

Employees act on behalf of an owner. They can manage reservations, buildings, units, and related data based on direct permissions assigned by the owner.

## Role requirements

- Routes require the `employee` role.
- The employee account must be `active`.
- Employees belong to an `Owner` and optionally to a specific `Building`.

## Profile

| Method | Path | Description |
|--------|------|-------------|
| GET | `/api/v1/employee/profile` | Get own employee profile. |
| PUT | `/api/v1/employee/profile` | Update own employee profile. |

## Shared owner/employee routes

The following routes accept both `owner` and `employee` roles. Owners are gated by approval status; employees are gated by the specific direct permissions assigned to them.

### Buildings

| Method | Path | Description |
|--------|------|-------------|
| GET | `/api/v1/buildings` | List buildings. |
| POST | `/api/v1/buildings` | Create a building. |
| GET | `/api/v1/buildings/{building}` | Show a building. |
| PUT | `/api/v1/buildings/{building}` | Update a building. |
| DELETE | `/api/v1/buildings/{building}` | Delete a building. |
| PUT | `/api/v1/buildings/{building}/disable` | Disable a building. |
| POST | `/api/v1/buildings/{building}/photos` | Upload building photos. |
| GET | `/api/v1/buildings/{building}/facilities` | List building facilities. |
| POST | `/api/v1/buildings/{building}/facilities` | Assign facilities. |
| DELETE | `/api/v1/buildings/{building}/facilities/{facility}` | Unassign a facility. |
| GET | `/api/v1/buildings/{building}/units` | List units in a building. |
| POST | `/api/v1/buildings/{building}/units/bulk` | Bulk-create units. |

### Facilities

| Method | Path | Description |
|--------|------|-------------|
| GET | `/api/v1/facilities` | List facilities. |
| POST | `/api/v1/facilities` | Create a facility. |
| GET | `/api/v1/facilities/{facility}` | Show a facility. |
| PUT | `/api/v1/facilities/{facility}` | Update a facility. |
| DELETE | `/api/v1/facilities/{facility}` | Delete a facility. |

### Units

| Method | Path | Description |
|--------|------|-------------|
| GET | `/api/v1/owner/units` | List owner's units. |
| POST | `/api/v1/owner/units` | Create a unit. |
| GET | `/api/v1/owner/units/{unit}` | Show a unit. |
| PUT | `/api/v1/owner/units/{unit}` | Update a unit. |
| DELETE | `/api/v1/owner/units/{unit}` | Delete a unit. |
| POST | `/api/v1/owner/units/{unit}/photos` | Upload unit photos. |
| GET | `/api/v1/owner/units/{unit}/facilities` | List unit facilities. |
| POST | `/api/v1/owner/units/{unit}/facilities` | Assign facilities. |
| DELETE | `/api/v1/owner/units/{unit}/facilities/{facility}` | Unassign a facility. |

### Employees

| Method | Path | Description |
|--------|------|-------------|
| GET | `/api/v1/employees` | List employees. |
| POST | `/api/v1/employees` | Create an employee. |
| GET | `/api/v1/employees/{employee}` | Show an employee. |
| PUT | `/api/v1/employees/{employee}` | Update an employee. |
| DELETE | `/api/v1/employees/{employee}` | Delete an employee. |

### Reservations

| Method | Path | Description |
|--------|------|-------------|
| GET | `/api/v1/reservations` | List reservations. |
| POST | `/api/v1/reservations` | Create a reservation. |
| GET | `/api/v1/reservations/{reservation}` | Show a reservation. |
| PUT | `/api/v1/reservations/{reservation}` | Update a reservation. |
| DELETE | `/api/v1/reservations/{reservation}` | Cancel a reservation. |
| POST | `/api/v1/reservations/{reservation}/check-in` | Check in a guest. |
| POST | `/api/v1/reservations/{reservation}/check-out` | Check out a guest. |
| POST | `/api/v1/reservations/on-arrival/prepare` | Start an on-arrival booking. |
| POST | `/api/v1/reservations/on-arrival/validate` | Validate the on-arrival OTP. |
| POST | `/api/v1/reservations/on-arrival/verify` | Verify the on-arrival OTP. |

### Promo codes

| Method | Path | Description |
|--------|------|-------------|
| GET | `/api/v1/promo-codes` | List promo codes. |
| POST | `/api/v1/promo-codes` | Create a promo code. |
| GET | `/api/v1/promo-codes/{promo_code}` | Show a promo code. |
| PUT | `/api/v1/promo-codes/{promo_code}` | Update a promo code. |
| DELETE | `/api/v1/promo-codes/{promo_code}` | Delete a promo code. |
| POST | `/api/v1/promo-codes/preview` | Preview promo-code discount. |

### Customers

| Method | Path | Description |
|--------|------|-------------|
| GET | `/api/v1/owner/customers` | List customers scoped to the owner's buildings. |

## Scoped access

Employees see data scoped to their owner (or building, if assigned). Their ability to create, update, or delete resources depends on the direct Spatie permissions assigned by the owner (for example `buildings.create`, `units.delete`, `reservations.update`).

For detailed schemas, see [`auto-generated.md`](../auto-generated.md).