# Business Made · Setup

Part of AppEngine API Documentation. Full index: https://appengine.appmint.io/documentation.md
## POST /business-made/setup/demo-hr-payroll

**Seed demo HR and payroll data**

`operationId: SetupController_seedDemoHrPayroll`

Idempotent: ensures a demo@appmint.io user with a linked employee, payroll config, a payroll profile, three full payroll runs (calculate → approve → process → pay stubs) and recruitment data.

**Never run this against a production org.** It writes fictional people into the same collections real employees live in, and they appear in headcount, payroll runs and reports.

#### Signature

```http
POST /business-made/setup/demo-hr-payroll () -> The seeded data
```

#### Access

Public — no credentials required.

#### Notes

- Public route: no sign-in is checked — the `orgid` header alone chooses the org.
- Demo data is indistinguishable from real data once created.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `GET /business-made/setup/status`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The seeded data |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /business-made/setup

**Health check**

`operationId: SetupController_health`

Answers `{ status: "ok", service: "business-made", time }`.

#### Signature

```http
GET /business-made/setup () -> Health
```

#### Access

Public — no credentials required.

#### Notes

- Public route: no sign-in is checked — the `orgid` header alone chooses the org.

#### Errors

Plus the standard platform errors: `429`, `500`.

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Health |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /business-made/setup/locations

**Seed demo locations**

`operationId: SetupController_seedLocations`

Creates demo business locations.

#### Signature

```http
POST /business-made/setup/locations () -> The result
```

#### Access

Public — no credentials required.

#### Notes

- Public route: no sign-in is checked — the `orgid` header alone chooses the org.

#### Errors

Plus the standard platform errors: `429`, `500`.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The result |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /business-made/setup/vendors

**Seed vendors**

`operationId: SetupController_seedVendors`

Creates default vendor records.

#### Signature

```http
POST /business-made/setup/vendors () -> The result
```

#### Access

Public — no credentials required.

#### Notes

- Public route: no sign-in is checked — the `orgid` header alone chooses the org.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `GET /business-made/vendors`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The result |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /business-made/setup/chart-of-accounts

**Seed the chart of accounts**

`operationId: SetupController_seedCoA`

Creates a standard chart of accounts. Get this right before posting anything — restructuring accounts after entries exist is considerably harder.

#### Signature

```http
POST /business-made/setup/chart-of-accounts () -> The result
```

#### Access

Public — no credentials required.

#### Notes

- Public route: no sign-in is checked — the `orgid` header alone chooses the org.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `GET /business-made/books/accounts`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The result |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /business-made/setup/product-attributes

**Seed product attributes**

`operationId: SetupController_seedProductAttributes`

Creates the `businessLocation` and `prepStation` product attribute definitions.

#### Signature

```http
POST /business-made/setup/product-attributes () -> The result
```

#### Access

Public — no credentials required.

#### Notes

- Public route: no sign-in is checked — the `orgid` header alone chooses the org.

#### Errors

Plus the standard platform errors: `429`, `500`.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The result |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /business-made/setup/workflows

**Seed the canonical workflows**

`operationId: SetupController_seedWorkflows`

Creates every canonical workflow template (prep, reservation-checkin, pickup, application-processing, service-appointment, renewal).

#### Signature

```http
POST /business-made/setup/workflows () -> The result
```

#### Access

Public — no credentials required.

#### Notes

- Public route: no sign-in is checked — the `orgid` header alone chooses the org.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /business-made/setup/workflows/{name}`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The result |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /business-made/setup/workflows/{name}

**Seed one canonical workflow**

`operationId: SetupController_seedOneWorkflow`

Creates one canonical workflow template.

#### Signature

```http
POST /business-made/setup/workflows/{name} (name: string) -> The result
```

#### Access

Public — no credentials required.

#### Notes

- Public route: no sign-in is checked — the `orgid` header alone chooses the org.

#### Errors

Plus the standard platform errors: `429`, `500`.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `name` | path | "prep" \| "reservation-checkin" \| "pickup" \| "application-processing" \| "service-appointment" \| "renewal" | yes | Workflow. |

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The result |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /business-made/setup/all

**Seed everything**

`operationId: SetupController_seedAll`

Seeds locations, vendors, the chart of accounts, product attributes and the canonical workflows in one call.

#### Signature

```http
POST /business-made/setup/all () -> The result
```

#### Access

Public — no credentials required.

#### Notes

- Public route: no sign-in is checked — the `orgid` header alone chooses the org.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `GET /business-made/setup/status`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The result |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /business-made/setup/status

**Get setup status**

`operationId: SetupController_getStatus`

The org's setup progress: its business profile, and which scenarios and modules have been applied and when.

#### Signature

```http
GET /business-made/setup/status () -> { profile, scenarios: { <key>: { completedAt, completedBy, summary } }, modules: { … } }
```

#### Access

Public — no credentials required.

#### Notes

- Public route: no sign-in is checked — the `orgid` header alone chooses the org.

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `404` | — | Company <orgId> not found in Root Org | The `orgid` header names no organization. | — |

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /business-made/setup/profile/save`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | { profile, scenarios: { <key>: { completedAt, completedBy, summary } }, modules: { … } } |
| `404` | Company <orgId> not found in Root Org — The `orgid` header names no organization. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /business-made/setup/profile/save

**Save the business profile**

`operationId: SetupController_saveProfile`

Saves the org's business profile — the first setup step, completed before scenarios and modules are applied.

#### Signature

```http
POST /business-made/setup/profile/save (body) -> The setup status
```

#### Access

Public — no credentials required.

#### Notes

- Public route: no sign-in is checked — the `orgid` header alone chooses the org.

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `400` | — | businessName is required | `businessName` is missing or blank. | — |
| `404` | — | Company <orgId> not found in Root Org | The `orgid` header names no organization. | — |

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /business-made/setup/scenario/apply`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

```json
{
  "businessName": "Harbor Coffee",
  "industry": "cafe",
  "fiscalYearStart": "01-01",
  "currency": "USD",
  "timezone": "America/New_York"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The setup status |
| `400` | businessName is required — `businessName` is missing or blank. |
| `404` | Company <orgId> not found in Root Org — The `orgid` header names no organization. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /business-made/setup/scenario/apply

**Apply a setup scenario**

`operationId: SetupController_applyScenario`

Applies a whole business shape at once: runs every module the scenario bundles, creating their default records, and marks the scenario complete.

#### Signature

```http
POST /business-made/setup/scenario/apply (body) -> { status, summary: { <module>: { created, skipped, details? } } }
```

#### Access

Public — no credentials required.

#### Notes

- Public route: no sign-in is checked — the `orgid` header alone chooses the org.

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `400` | — | Unknown scenario: <scenario> | `scenario` is not one of the listed keys. | — |
| `404` | — | Company <orgId> not found in Root Org | The `orgid` header names no organization. | — |

Plus the standard platform errors: `429`, `500`.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

```json
{
  "scenario": "cafe"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | { status, summary: { <module>: { created, skipped, details? } } } |
| `400` | Unknown scenario: <scenario> — `scenario` is not one of the listed keys. |
| `404` | Company <orgId> not found in Root Org — The `orgid` header names no organization. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /business-made/setup/module/apply

**Apply one setup module**

`operationId: SetupController_applyModule`

Creates the default records one module needs, à la carte, and marks the module complete.

#### Signature

```http
POST /business-made/setup/module/apply (body) -> { status, summary: { created, skipped, details? } }
```

#### Access

Public — no credentials required.

#### Notes

- Public route: no sign-in is checked — the `orgid` header alone chooses the org.

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `400` | — | Unknown module: <module> | `module` is not one of the listed keys. | — |
| `404` | — | Company <orgId> not found in Root Org | The `orgid` header names no organization. | — |

Plus the standard platform errors: `429`, `500`.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

```json
{
  "module": "payroll"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | { status, summary: { created, skipped, details? } } |
| `400` | Unknown module: <module> — `module` is not one of the listed keys. |
| `404` | Company <orgId> not found in Root Org — The `orgid` header names no organization. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |