# Check-in

Part of AppEngine API Documentation. Full index: https://appengine.appmint.io/documentation.md
## POST /checkin/walk-in

**Check in a walk-in guest**

`operationId: CheckinController_walkIn`

Creates a queue entry for a guest who arrived without a reservation. No Reservation record is created or needed — the queue entry is the Task, and a walk-in simply starts at stage 0 of the check-in pipeline.

At least one of name, email or phone must be present in `customer`; the contact details are what the "your table is ready" notification is later sent to.

#### Signature

```http
POST /checkin/walk-in (body) -> The queue entry
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `400` | CUSTOMER_REQUIRED | customer is required (name/email/phone) | `customer` is missing or has none of name, email or phone. | Supply at least one contact detail. |
| `500` | TASK_CREATE_FAILED | Failed to create check-in task | The pipeline task could not be created. | Retry; if it persists the check-in pipeline may not exist for this org. |

Plus the standard platform errors: `401`, `403`, `429`.

#### See also

- `POST /checkin/from-reservation/{reservationId}`
- `GET /checkin/queue`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

The arriving guest.

```json
{
  "businessLocationId": "LOC-3",
  "customer": {
    "name": "Ada Lovelace",
    "phone": "+15551234567"
  },
  "partySize": 4,
  "notes": "Celebrating a birthday"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The queue entry |
| `400` | customer is required (name/email/phone) — `customer` is missing or has none of name, email or phone. |
| `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | Failed to create check-in task — The pipeline task could not be created. |

## POST /checkin/from-reservation/{reservationId}

**Check in a reserved guest**

`operationId: CheckinController_fromReservation`

Creates a queue entry linked to an existing reservation — the guest who booked has now physically arrived. The reservation stays as it was; the queue entry is a new Task that carries the reservation's party and contact details forward.

Calling it twice creates a second queue entry for the same reservation — check the queue before re-checking someone in.

#### Signature

```http
POST /checkin/from-reservation/{reservationId} (reservationId: string, body) -> The queue entry
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Notes

- Not idempotent — repeated calls queue the guest twice.

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `404` | RESERVATION_NOT_FOUND | Reservation not found | No reservation has that id. | Check the id, or use `POST /checkin/walk-in`. |
| `500` | TASK_CREATE_FAILED | Failed to create check-in task | The pipeline task could not be created. | Retry. |

Plus the standard platform errors: `401`, `403`, `429`.

#### See also

- `GET /checkin/upcoming`
- `GET /checkin/reservations/today`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `reservationId` | path | string | yes | The reservation being honoured. |

### Request body

Overrides — party size, notes, location.

```json
{
  "partySize": 5,
  "notes": "Two extra guests"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The queue entry |
| `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `404` | Reservation not found — No reservation has that id. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | Failed to create check-in task — The pipeline task could not be created. |

## POST /checkin/{taskId}/assign

**Assign a service point**

`operationId: CheckinController_assign`

Seats the guest: marks the service point occupied, advances the task to its terminal stage — removing it from the live queue — and **notifies the customer** that their table is ready.

The notification goes out on the contact details captured at check-in, so this is an outward-facing action. A task already assigned is refused rather than re-notified.

#### Signature

```http
POST /checkin/{taskId}/assign (taskId: string, body) -> The seated entry
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Notes

- Sends a notification to the guest.

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `404` | TASK_NOT_FOUND | Check-in task not found | No check-in task has that id. | Read the live queue with `GET /checkin/queue`. |
| `400` | SERVICE_POINT_REQUIRED | servicePointId required | `servicePointId` is missing. | Supply a service point id. |
| `409` | SERVICE_POINT_UNAVAILABLE | Service point not available | The service point is occupied, dirty, closed or reserved. | Pick an open one from `GET /checkin/service-point/available`, or clear it first. |

Plus the standard platform errors: `401`, `403`, `429`, `500`.

#### See also

- `GET /checkin/service-point/available`
- `POST /checkin/service-point/{spId}/clear`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `taskId` | path | string | yes | Check-in task id. |

### Request body

Which service point.

```json
{
  "servicePointId": "SP-12"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The seated entry |
| `400` | servicePointId required — `servicePointId` is missing. |
| `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `404` | Check-in task not found — No check-in task has that id. |
| `409` | Service point not available — The service point is occupied, dirty, closed or reserved. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /checkin/{taskId}/leave

**Guest left the queue**

`operationId: CheckinController_leave`

Removes a guest who gave up waiting. Distinct from a no-show: they arrived and then left, which is a wait-time problem rather than a booking one, and the two are counted separately in queue history.

#### Signature

```http
POST /checkin/{taskId}/leave (taskId: string, body) -> The closed entry
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `404` | TASK_NOT_FOUND | Check-in task not found | No check-in task has that id. | Read the live queue with `GET /checkin/queue`. |

Plus the standard platform errors: `401`, `403`, `429`, `500`.

#### See also

- `POST /checkin/{taskId}/no-show`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `taskId` | path | string | yes | Check-in task id. |

### Request body

Optional reason.

```json
{
  "reason": "Wait too long"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The closed entry |
| `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `404` | Check-in task not found — No check-in task has that id. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /checkin/{taskId}/no-show

**Mark a guest as a no-show**

`operationId: CheckinController_noShow`

Closes a queue entry for a guest who never turned up — typically a reservation check-in created ahead of arrival. Kept distinct from "left" so no-show rates stay meaningful.

#### Signature

```http
POST /checkin/{taskId}/no-show (taskId: string) -> The closed entry
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `404` | TASK_NOT_FOUND | Check-in task not found | No check-in task has that id. | Read the live queue with `GET /checkin/queue`. |

Plus the standard platform errors: `401`, `403`, `429`, `500`.

#### See also

- `POST /checkin/{taskId}/leave`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `taskId` | path | string | yes | Check-in task id. |

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The closed entry |
| `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `404` | Check-in task not found — No check-in task has that id. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /checkin/{taskId}/notify

**Re-send the ready notification**

`operationId: CheckinController_notify`

Sends the "your table is ready" message again — for a guest who did not see the first one. This sends a real message to the guest each time it is called; there is no rate limit here.

#### Signature

```http
POST /checkin/{taskId}/notify (taskId: string) -> The send result
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Notes

- Outward-facing: every call messages the guest.

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `404` | TASK_NOT_FOUND | Check-in task not found | No check-in task has that id. | Read the live queue with `GET /checkin/queue`. |

Plus the standard platform errors: `401`, `403`, `429`, `500`.

#### See also

- `POST /checkin/{taskId}/assign`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `taskId` | path | string | yes | Check-in task id. |

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The send result |
| `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `404` | Check-in task not found — No check-in task has that id. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /checkin/service-point/{spId}/clear

**Clear a service point**

`operationId: CheckinController_clearServicePoint`

Frees a service point after a party leaves. `finalStatus` decides what it becomes: `dirty` when it still needs bussing, `available` when it is ready for the next guest — only `available` points can be assigned.

#### Signature

```http
POST /checkin/service-point/{spId}/clear (spId: string, body) -> The cleared service point
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `404` | SERVICE_POINT_NOT_FOUND | Service point not found | No service point has that id. | List them with `GET /checkin/service-point`. |

Plus the standard platform errors: `401`, `403`, `429`, `500`.

#### See also

- `GET /checkin/service-point/available`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `spId` | path | string | yes | Service point id. |

### Request body

The status to leave it in.

```json
{
  "finalStatus": "dirty"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The cleared service point |
| `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `404` | Service point not found — No service point has that id. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /checkin/service-point/available

**List available service points**

`operationId: CheckinController_listAvailableServicePoints`

Only the service points that can be assigned right now — the host's "what's open" view. Excludes occupied, dirty, closed and reserved.

#### Signature

```http
GET /checkin/service-point/available (businessLocationId?: string) -> Available service points
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

Plus the standard platform errors: `401`, `403`, `429`, `500`.

#### See also

- `GET /checkin/service-point`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `businessLocationId` | query | string | — | Limit to one location. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Available service points |
| `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /checkin/service-point

**List all service points**

`operationId: CheckinController_listAllServicePoints`

The full floor view: every service point at a location in any status — open, occupied, dirty, closed, reserved. Occupied and reserved points are enriched with the check-in task currently assigned to them (customer name, party size, `seatedAt`, `seatedMs`), so a floor plan renders from this one call.

#### Signature

```http
GET /checkin/service-point (businessLocationId?: string) -> All service points, enriched where occupied
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

Plus the standard platform errors: `401`, `403`, `429`, `500`.

#### See also

- `GET /checkin/service-point/available`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `businessLocationId` | query | string | — | Limit to one location. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | All service points, enriched where occupied |
| `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /checkin/queue

**Get the live queue**

`operationId: CheckinController_listQueue`

Everyone currently waiting — the tasks still at stage 0 of the check-in pipeline. Seated, left, no-show and cancelled entries are not here; they are in the queue history.

#### Signature

```http
GET /checkin/queue (businessLocationId?: string, partySize?: integer, source?: string) -> Waiting guests
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

Plus the standard platform errors: `401`, `403`, `429`, `500`.

#### See also

- `GET /checkin/queue/summary`
- `GET /checkin/queue/history`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `businessLocationId` | query | string | — | Limit to one location. |
| `partySize` | query | integer | — | Filter by party size. |
| `source` | query | string | — | `walk-in` or `reservation`. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Waiting guests |
| `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /checkin/queue/history

**Get queue history**

`operationId: CheckinController_queueHistory`

Entries that have left the live queue — assigned, completed, no-show, left or cancelled. The "what came through earlier" view.

`sinceMs` is a **duration in milliseconds looking back from now**, not a timestamp: `86400000` is the last 24 hours.

#### Signature

```http
GET /checkin/queue/history (businessLocationId?: string, sinceMs?: integer, pageSize?: integer) -> Past queue entries
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

Plus the standard platform errors: `401`, `403`, `429`, `500`.

#### See also

- `GET /checkin/queue`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `businessLocationId` | query | string | — | Limit to one location. |
| `sinceMs` | query | integer | — | Look-back window in milliseconds. `86400000` = last 24 hours. |
| `pageSize` | query | integer | — |  |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Past queue entries |
| `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /checkin/queue/summary

**Get a queue summary**

`operationId: CheckinController_queueSummary`

Headline queue figures — how many are waiting, the current average wait and the longest party currently waiting. The one call a status board needs.

#### Signature

```http
GET /checkin/queue/summary (businessLocationId?: string) -> The summary
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

Plus the standard platform errors: `401`, `403`, `429`, `500`.

#### See also

- `GET /checkin/queue`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `businessLocationId` | query | string | — | Limit to one location. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | The summary |
| `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /checkin/upcoming

**List upcoming reservations**

`operationId: CheckinController_upcoming`

Reservations expected within the next N hours that have **not** yet been checked in — who the host should be watching the door for. Once a reservation is checked in it drops out of this list and appears in the live queue.

#### Signature

```http
GET /checkin/upcoming (businessLocationId?: string, windowHours?: number) -> Expected reservations
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

Plus the standard platform errors: `401`, `403`, `429`, `500`.

#### See also

- `POST /checkin/from-reservation/{reservationId}`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `businessLocationId` | query | string | — | Limit to one location. |
| `windowHours` | query | number | — | Look-ahead window in hours. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Expected reservations |
| `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /checkin/reservations/today

**List today's reservations**

`operationId: CheckinController_reservationsToday`

Every reservation for the whole calendar day in any status — the check-in page's "Today" view, unlike `upcoming` which is a forward window of not-yet-arrived guests.

Pass `tzOffsetMinutes` (the browser's `new Date().getTimezoneOffset()`) so the day boundary matches the operator's timezone rather than the server's — without it a late-evening reservation can land on the wrong day.

#### Signature

```http
GET /checkin/reservations/today (businessLocationId?: string, tzOffsetMinutes?: integer) -> Today's reservations
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Notes

- Omitting `tzOffsetMinutes` uses the server day boundary.

#### Errors

Plus the standard platform errors: `401`, `403`, `429`, `500`.

#### See also

- `GET /checkin/upcoming`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `businessLocationId` | query | string | — | Limit to one location. |
| `tzOffsetMinutes` | query | integer | — | The operator's UTC offset in minutes, as returned by `Date.prototype.getTimezoneOffset()`. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Today's reservations |
| `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /checkin/queue/position/{taskId}

**Get queue position and ETA**

`operationId: CheckinController_position`

How far up the queue a party is and roughly how long they still have to wait — the answer to "how long?" at the host stand. The ETA is projected from recent throughput, so treat it as an estimate rather than a promise to the guest.

#### Signature

```http
GET /checkin/queue/position/{taskId} (taskId: string) -> Position and estimated wait
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Notes

- The ETA is a projection from recent seating rates.

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `404` | TASK_NOT_FOUND | Check-in task not found | No check-in task has that id. | Read the live queue with `GET /checkin/queue`. |

Plus the standard platform errors: `401`, `403`, `429`, `500`.

#### See also

- `GET /checkin/queue/summary`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `taskId` | path | string | yes | Check-in task id. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Position and estimated wait |
| `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `404` | Check-in task not found — No check-in task has that id. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /checkin/queue/{taskId}

**Get one queue entry**

`operationId: CheckinController_getQueueEntry`

Fetches a single check-in entry with its customer, party and status.

#### Signature

```http
GET /checkin/queue/{taskId} (taskId: string) -> The queue entry
```

#### Access

Requires a bearer JWT (`Authorization: Bearer <token>`).

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `404` | TASK_NOT_FOUND | Check-in task not found | No check-in task has that id. | Read the live queue with `GET /checkin/queue`. |

Plus the standard platform errors: `401`, `403`, `429`, `500`.

#### See also

- `GET /checkin/queue/position/{taskId}`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `taskId` | path | string | yes | Check-in task id. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | The queue entry |
| `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. |
| `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. |
| `404` | Check-in task not found — No check-in task has that id. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |