GIRA · DEVELOPERS
API reference
The Gira API provides authenticated customer, vendor, application and provisioning routes. Every protected request is verified by the API and authorized from current Gira membership data.
https://giranow-staging-api.web.appSend Firebase Identity Platform ID tokens as a bearer token on protected routes. The API independently validates the token, then resolves the user's role and tenant membership from the database. Client-supplied role or tenant identifiers are never trusted.
Health and identity
| Method | Path | Behavior |
|---|---|---|
| GET | /health | Process liveness; returns a minimal status. |
| GET | /readyz | Readiness check including a database ping; returns no data. |
| GET | /whoami | Verified profile and database-resolved memberships. |
| GET | /v1/admin/me | Confirms an authorized administrator role. |
Customer and vendor reads
| Method | Path | Behavior |
|---|---|---|
| GET | /v1/customers/me | Returns only the signed-in customer's own profile. |
| GET | /v1/customers/me/applications | Lists the signed-in customer's application statuses. |
| GET | /v1/vendors | Lists vendors visible to the authenticated membership. |
| GET | /v1/vendors/{vendor_id} | Reads a vendor after server-side scope authorization. |
| GET | /v1/vendors/{vendor_id}/agents | Lists agents in an authorized vendor. |
| GET | /v1/customers?vendor_id=… | Lists customers only for an authorized vendor. |
| GET | /v1/applications?vendor_id=… | Lists applications within authorized vendor scope. |
Staff and provisioning
| Method | Path | Behavior |
|---|---|---|
| GET | /v1/applications/{application_id} | Reads an application only when caller scope permits. |
| GET | /v1/devices/{device_id} | Returns a non-sensitive device-state projection when the required database amendment is active. |
| POST | /v1/provisioning/actions | Authenticated staff proxy to the private provisioning service. Only explicitly allowlisted actions are accepted. |
Errors and safe use
Errors use a stable envelope with an error code, safe summary and request ID. Never retry an irreversible operation without an idempotency key. Do not send tenant IDs or role claims as authorization input.
Important: Routes not listed here are not promised by this reference. Payment execution, signed lease offers, installment schedules, customer application writes, full admin mutations, and production DNS routing still need their respective implementation and integration checks. The API does not provide arbitrary database CRUD.