Authentication

SponsorLink uses private UUID tokens (36-character) for entity-level access. Tokens are assigned at signup and act as non-guessable access keys. Admin endpoints require session-based authentication with email + PIN + 2FA OTP verification.

            # Example: Fetch club profile by token

            GET /api/v1/clubs/<token>

            # Example: Update business profile (requires session auth)

            PUT /api/v1/businesses/<token>

            Content-Type: application/json

            Cookie: session=<session_cookie>

Public Endpoints No Auth Required

These endpoints return publicly-available platform data.

GET /api/v1/directory

Returns the public business sponsor directory with name, category, offer, address, and website.

Response Fields

                        name, category, offer, address, website, image_url, status
                    

GET /api/v1/clubs

Returns the public club directory with name, address, member count, and logo.

Response Fields

                        name, address, members_count, logo_url
                    

GET /api/v1/public/stats

Returns aggregate platform statistics (total clubs, businesses, members, transactions).

GET /api/v1/status

Returns system operational status, database connectivity, and response latency.

Club Management Club Exec Auth Required

Endpoints for club executive members (President, Secretary, Treasurer). Requires authenticated session matching the club token.

GET PUT /api/v1/clubs/<token>

Read or update the club profile (name, image, blurb, calendar URL, contact link).

GET POST /api/v1/club/<token>/dues-tiers

List or create membership dues tiers (title, amount, duration, season dates).

GET /api/v1/club/<token>/analytics

Returns club financial analytics (total revenue, member savings, dues collected, transaction breakdown).

POST /api/v1/club/<token>/broadcast

Send a broadcast SMS notification to all active club members.

POST /api/v1/club/<token>/import-members

Bulk import members from CSV or Excel (.xlsx) file upload.

Business Partner Business Auth Required

Endpoints for authenticated business partners. Requires session matching the business token owner.

GET PUT /api/v1/businesses/<token>

Read or update the business profile (name, image, blurb, Google review URL).

POST /api/business/<token>/site-scan

Pro plan: run the website safety & search check on the website saved on the business profile (5 a day).

POST /api/v1/business/<token>/setup-direct-debit

Initialize Stripe BECS Direct Debit billing for the business partner.

Member Token-Based Access

Member endpoints are accessed using the member's private UUID token.

GET PUT /api/v1/members/<token>

Read or update the member profile (name, email, mobile, discount split, SMS preferences).

DELETE /api/v1/members/<token>

Permanently delete a member account and all associated data (GDPR/Privacy Act compliance).

POST /api/v1/member/register

Register a new member (name, email, mobile, club selection).

POS Webhooks Signature Verified

Incoming webhook receivers from POS integrations. These are called by third-party platforms, not by clients directly.

POST /api/v1/stripe/webhooks

Stripe payment events (BECS Direct Debit succeeded/failed, Connect payouts). HMAC signature verified.

POST /api/v1/shopify/webhooks/orders-paid

Shopify order completion events. HMAC-SHA256 signature verified against app secret.

POST /api/v1/square/webhooks/payment-updated

Square payment completion events. Matched by location_id.

Deprecation Notice

The unversioned /api/... endpoints remain active but are deprecated. All clients should migrate to the /api/v1/... prefix. Unversioned routes will return a Deprecation: true HTTP header.

For the full list of changes, see the API Changelog.

API Documentation