API Reference

Users

Manage your restaurant staff accounts. Create waiters, assign roles, set PINs for quick login, and control access. All endpoints require admin privileges.

Security

The password_hash and pin fields are never included in API responses (json:"-"). Passwords are hashed with bcrypt before storage.

List Users

GET/api/usersAdmin Only

Returns a list of all staff members.

bash

curl https://api.possfer.com/api/users \
  -H "Authorization: Bearer <token>"

json

{
  __PH0__: [
    {
      __PH1__: "550e8400-e29b-41d4-a716-446655440000",
      __PH3__: "max@restaurant.de",
      __PH5__: "Max",
      __PH7__: "Mustermann",
      __PH9__: "admin",
      __PH11__: true,
      __PH12__: "2026-01-15T10:00:00Z",
      __PH14__: "2026-03-10T14:30:00Z"
    },
    {
      __PH16__: "550e8400-e29b-41d4-a716-446655440001",
      __PH18__: "anna@restaurant.de",
      __PH20__: "Anna",
      __PH22__: "Schmidt",
      __PH24__: "waiter",
      __PH26__: true,
      __PH27__: "2026-02-01T09:00:00Z",
      __PH29__: "2026-02-01T09:00:00Z"
    }
  ]
}

Create User

Create a new staff member account. The password is hashed with bcrypt before storage and is never returned in responses.

POST/api/usersAdmin Only

Create a new staff member.

Request Body

Name	Type	Required	Description
`email`	`string`	Required	Email address for the user account.
`password`	`string`	Required	Password for the user account. Hashed with bcrypt.
`first_name`	`string`	Required	First name of the staff member.
`last_name`	`string`	Required	Last name of the staff member.
`role`	`string`	Optional	Role: "admin", "manager", or "waiter". Defaults to "waiter".
`pin`	`string`	Optional	4-digit PIN for quick terminal login. Optional.

bash

curl -X POST https://api.possfer.com/api/users \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "lisa@restaurant.de",
    "password": "secure-password-123",
    "first_name": "Lisa",
    "last_name": "Mueller",
    "role": "waiter",
    "pin": "1234"
  }'

json

{
  __PH0__: "550e8400-e29b-41d4-a716-446655440002",
  __PH2__: "lisa@restaurant.de",
  __PH4__: "Lisa",
  __PH6__: "Mueller",
  __PH8__: "waiter",
  __PH10__: true,
  __PH11__: "2026-03-20T10:00:00Z",
  __PH13__: "2026-03-20T10:00:00Z"
}

Update User

Update an existing staff member. All fields are optional — only provided fields will be updated.

PUT/api/users/:idAdmin Only

Update an existing staff member by ID.

Path Parameters

Name	Type	Required	Description
`id`	`uuid`	Required	The user ID.

Request Body

Name	Type	Required	Description
`first_name`	`string`	Optional	Updated first name.
`last_name`	`string`	Optional	Updated last name.
`role`	`string`	Optional	Updated role: "admin", "manager", or "waiter".
`pin`	`string`	Optional	Updated 4-digit PIN.
`is_active`	`boolean`	Optional	Set to false to deactivate the user without deleting.

bash

curl -X PUT https://api.possfer.com/api/users/550e8400-e29b-41d4-a716-446655440002 \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "role": "manager",
    "is_active": true
  }'

json

{
  __PH0__: "550e8400-e29b-41d4-a716-446655440002",
  __PH2__: "lisa@restaurant.de",
  __PH4__: "Lisa",
  __PH6__: "Mueller",
  __PH8__: "manager",
  __PH10__: true,
  __PH11__: "2026-03-20T10:00:00Z",
  __PH13__: "2026-03-20T15:30:00Z"
}