B2B v2 Route Inventory

• Audit date: 2026-07-17
• Documentation baseline: ab124d9e25df
• Backend baseline: 81686b34e5bc (origin/master)
• Raw backend surface: 60 operations
• Published public surface: 42 operations

Seven of the needs decision operations are the Waiting List group. The available production Business User receives 403 for both collection reads, so they remain unpublished until a positive production contract can be verified with an authorized fixture.

The engineering ratio is therefore 42 of 60. The approved public denominator is currently 42, and all 42 approved operations are published. This does not imply that all 60 registered routes are approved public APIs.

• Auth P+U+L: Partner token, Business User token, and active Location license checks are required. Controllers may apply additional access checks.
• Test I: a route-name integration test exists at the backend baseline.
• Test N: no route-name or controller integration test was found.
• Live: positive production behavior was verified during the 2026-07-15 contract audit or the 2026-07-16 canonical URL check.
• Route: only route reachability, validation behavior, or a non-positive response was verified in production.
• Source: controller, request, transformer, service, and/or UI consumer was inspected at the backend baseline.

All canonical routes below are relative to https://api.alteg.io/api/v2.

The literal company_id parameter remains in Tags and Positions for SDK compatibility. It identifies a Location. The middleware also accepts the legacy /companies/{company_id} path alias.

• Authenticated Tags list: canonical /locations and compatibility /companies both returned 200 with identical response bodies.
• Authenticated Positions list: canonical /locations and compatibility /companies both returned 200 with identical response bodies.
• Waiting List list and count: the only managed Location returned 403 for both operations. No Waiting List write was attempted.
• Attendance Appointments: positive 200 collection responses were verified with both record_{appointment_id} and visit_{visit_id} identifiers. An invalid identifier returned 422, and a missing attendance group returned 404.
• Attendance Booking User: positive 200 item responses were verified for several Booking User profiles without retaining personal data. The base response returned the client resource type and an empty meta array.
• Product Units returned 200 with 38 JSON:API unit resources.
• Attendance Services returned 200; a composite Service fixture was then used to verify its component Attendance Services with another 200.
• Resource Occupations, Attendance Service Suggestions, and Appointment Custom Fields returned 200 with deterministic empty collections for safe fixtures.
• Booking User Location and Chain attendance statistics returned 200 item responses with the expected JSON:API resource types and deposit relationship.
• No production data was created, updated, deleted, or included in this file.

Waiting List coverage requires a Business User and Location with positive read access. Publishing list and count then requires observed 200 shapes and a passing read-only Arazzo workflow. Its remaining five operations additionally require a controlled Booking User, notification safety, and guaranteed cleanup.

The other remaining read candidate requires a decision on the autocomplete route that the backend marks for deletion.