Open a shift at the desk
const url = 'https://api.aerandil.com/v1/desk/sessions';const options = { method: 'POST', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"outlet_id":"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0","property_id":"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.aerandil.com/v1/desk/sessions \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "outlet_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "property_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" }'With the bearer the identity-provider sign-in minted for a member of the desk staff (POST /v1/portal/token), open a desk_session at the house they work at — recorded as desk_session.opened under their principal — and answer with a desk bearer for them and the shift’s unlock token. Both end with the shift: the sign-in’s own expiry or AERANDIL_STAFF_SESSION_TTL, whichever is sooner. Refused to a machine principal, a token already minted for a desk session, a person with no staff record, an inactive one, and any role but the front office’s. Not idempotency-keyed: the response is a credential, and the idempotency cache would keep it.
Authorizations
Section titled “Authorizations”Request Body
Section titled “Request Body”object
The outlet whose till the session is (the till’s step 2). Named: a till, opened and handed on by the F&B floor’s roles (food_beverage_server, food_beverage_manager); the outlet must trade at the session’s property. Absent: the front desk, held by the front office’s roles. Neither kind seats the other’s roles.
The house the shift is at. Optional: unnamed, the shift opens at the signed-in staff record’s home (staff_works_at_property). A person who works at several houses has a staff record at each, claiming the same identity; naming one of those houses opens the shift there, as that record. A property they have no staff record at is refused.
Examplegenerated
{ "outlet_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "property_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"}Responses
Section titled “Responses”The shift is open.
object
Short-lived HS256 JWT. Send as Authorization: Bearer <token> on subsequent calls.
Token lifetime in seconds. Default 3600 (one hour); deployment-configurable via AERANDIL_TOKEN_TTL_SECS.
Space-separated list of granted scopes. The set the token actually carries — already narrowed by any scope request filter and the client’s pre-provisioned grants.
Always Bearer in v1.
Idle seconds after which the desk locks (AERANDIL_DESK_IDLE_LOCK).
The outlet whose till the session is; absent at the front desk.
The houses the person the bearer runs as may hold the desk at — one per front-office staff record claiming their identity — the choices POST /v1/desk/sessions/{id}/move takes.
The desk role the scope vector came from (the F&B roles at a till).
When the shift — and every token minted for it — ends.
The staff member the bearer runs as — its User principal.
Seconds a step-up is honoured for (AERANDIL_DESK_STEP_UP_TTL).
Until when this bearer carries a step-up proof. Absent on the sign-in’s own bearer: an identity-provider session may be silently re-used, so it is not a proof.
On a passcode proof: whether the desk changed hands.
Only when opening: what a locked desk keeps to come back by passcode.
Example
{ "token_type": "Bearer", "role": "front_desk"}Headers
Section titled “Headers”Always no-store. Object and link state is live data and is never cacheable.
Not a front-office member of staff signed in through the identity provider.
Structured error wrapper. Every non-2xx response from any Aerandil endpoint serialises to this shape; the HTTP status carries the failure class (4xx/5xx), the body adds a stable code for programmatic dispatch plus a human-readable message.
object
object
Stable, programmatic error code (e.g. unauthorized, forbidden, not_found, invalid_body, invalid_url, precondition_failed, no_secondary_key). Clients dispatch on code, not on the message (which may be localised or contextualised in future versions).
Request-id correlation handle echoed on the request-id response header — support teams correlate without scraping logs.
Human-readable explanation of the failure.
Per-error structured detail. The shape varies by code (e.g. forbidden_action carries {"action": "..."}; precondition_failed carries {"current_version": N}).
Examplegenerated
{ "error": { "code": "example", "instance_id": "example", "message": "example", "parameters": "example" }}No home property, several and none named, or a property they do not work at.
Structured error wrapper. Every non-2xx response from any Aerandil endpoint serialises to this shape; the HTTP status carries the failure class (4xx/5xx), the body adds a stable code for programmatic dispatch plus a human-readable message.
object
object
Stable, programmatic error code (e.g. unauthorized, forbidden, not_found, invalid_body, invalid_url, precondition_failed, no_secondary_key). Clients dispatch on code, not on the message (which may be localised or contextualised in future versions).
Request-id correlation handle echoed on the request-id response header — support teams correlate without scraping logs.
Human-readable explanation of the failure.
Per-error structured detail. The shape varies by code (e.g. forbidden_action carries {"action": "..."}; precondition_failed carries {"current_version": N}).
Examplegenerated
{ "error": { "code": "example", "instance_id": "example", "message": "example", "parameters": "example" }}