Front desk routes (add-on)
The narrowed routes the front desk app at /desk calls for somebody standing at the counter.
Opened by kahunacart.bookings.desk, or by kahunacart.bookings.desk.own for somebody who sees only their own column, plus api.access. They are a narrower family than the admin routes, not the same routes with a different permission: no answer carries an order id, a total, a provider, a refund or a coupon, and on desk.own every route is cut to the caller's own column on the server before anything is read. See The front desk and Developers.
Read who is signed in at the desk
/api/v1/kahunacart/bookings/desk/me
Who I am, which column is mine, what the shop is called, how it writes a time of day, the words the app prints, and the nonce every write has to carry
Read the desk diary
/api/v1/kahunacart/bookings/desk/diary
The columns and their appointments over a range, with each column's working hours and days off
Read the free times for a new booking
/api/v1/kahunacart/bookings/desk/slots
What is actually free, for the new-booking sheet and for Move
List the services at the desk
/api/v1/kahunacart/bookings/desk/services
What the shop books, with the sizes and lengths and who can do each
Find a customer at the desk
/api/v1/kahunacart/bookings/desk/customers
Search a person by name, email or phone, with their next appointment and their history
Add a customer at the desk
/api/v1/kahunacart/bookings/desk/customers
Add somebody who rang up and has never been in
Read a customer at the desk
/api/v1/kahunacart/bookings/desk/customers/{id}
How to reach them, how they are to deal with, and their next and last few bookings. No address, no orders and no spend. A stylist sees only the bookings in her own column.
Update a customer at the desk
/api/v1/kahunacart/bookings/desk/customers/{id}
Correct a name, a phone number or an email. Changing the email is for desk accounts that work the whole diary, not a stylist, and is refused when another customer already has it.
Book somebody in at the counter
/api/v1/kahunacart/bookings/desk/bookings
Book somebody in at the counter
Read an appointment at the desk
/api/v1/kahunacart/bookings/desk/bookings/{id}
One appointment: the customer, the phone, the notes, the answers, one line about money and the whole trail. payment.can_take_payment says whether Take payment shows (the Point of Sale add-on installed and on, the person holds kahunacart.pos.use or kahunacart.pos.manage, and the order still owes money), with payment.take_payment_url, the till's /pos#/pay/{order}, when it does and null when not
Act on an appointment at the desk
/api/v1/kahunacart/bookings/desk/bookings/{id}/{action}
{action} is one of check-in, complete, no-show, cancel, reschedule, approve or reject, and nothing else, because the list is in the route pattern.
The desk signs in with a session cookie, so every write carries a desk nonce: desk/me mints one and the app sends it back in X-Desk-Nonce. A write without it is refused with a sentence telling the person to reload. A request authenticated by an API key is not asked for one. None of the eleven is an MCP tool.