Organizations, sites, and people

The account backbone: the organization itself, its sites, and its members. All endpoints here require a user session; permissions noted per endpoint.

The organization

GET   /orgs/{orgId}          — the org row (name, slug, kind, settings)
PATCH /orgs/{orgId}          — update name / settings / kind        (owner)

settings is a JSON object carried on the organization. Notable keys: plan and trialEndsAt (managed by billing endpoints — don't write them directly), vertical, and brand:

PATCH /orgs/{orgId}

{ "settings": { "brand": { "primary": "#283040", "accent": "#F36744" } } }

Brand colors theme kitchen boards, menu boards, and diner-facing screens. `PATCH` replaces the whole `settings` object — read it first, merge, then write.

Operator organizations (kind: "operator") manage client organizations:

GET  /orgs/{orgId}/children   — client orgs under this operator      (admin)
POST /orgs/{orgId}/children   — create a client org                  (owner)

Sites

GET   /orgs/{orgId}/sites
POST  /orgs/{orgId}/sites                       (admin)
PATCH /orgs/{orgId}/sites/{siteId}              (admin; archive with {"archived": true})

A site list looks like:

[
  {
    "id": "76e372c4-0b3e-48ad-8ae2-2b6531081847",
    "orgId": "05b955b6-c196-4e31-a383-4251dee16f8a",
    "name": "Riverbend HQ — Tower Café",
    "code": "TWR",
    "address": null,
    "timezone": "America/New_York",
    "functionalAreas": ["foodservice"],
    "joinCode": "RIVER1",
    "populationTargetId": null,
    "archived": false,
    "createdAt": "2026-07-12 00:40:10.126421+00"
  }
]

The timezone matters: production days, tray generation, and every "today" on that site resolve in it. joinCode is the diner-app join code (null until minted).

Members

GET    /orgs/{orgId}/users                       — members with role, siteIds, credentials
POST   /orgs/{orgId}/users                       — invite            (admin)
PATCH  /orgs/{orgId}/users/{userId}              — role / siteIds / credentials / phone (admin)
DELETE /orgs/{orgId}/users/{userId}              — remove membership (admin)

Inviting:

{ "email": "sam@example.com", "name": "Sam Ortiz", "role": "manager", "siteIds": [], "credentials": ["rd"] }

If the person has no Miseline account, one is created and they're emailed a temporary password (or pass a password yourself and no email is sent). Inviting an existing member returns 409. role is one of owner | admin | manager | inspector | viewer; empty siteIds means all sites; credentials may include rd, servsafe, cdm.

Plan and usage

GET /orgs/{orgId}/billing        (any member)

Returns the current plan, trial state, limits, live usage (sites, devices, members, diners, AI tokens this month), and the available plans — the machine-readable version of the Billing page. Feature gating itself is enforced per-endpoint via the 402 paywall shape.

Notifications

GET  /orgs/{orgId}/notifications             — the caller's in-app notifications
POST /orgs/{orgId}/notifications/{id}/read