helloWorld
Liveness probe — echoes a greeting and the contract version.
TEMPORARY (ONE-2615). Delete this method, its DTOs and its controller when the first real operation ships; nothing partner-facing should depend on it.
Request
- namestring
Free text echoed back in the reply, e.g. "ping from catapult". Omit for a bare probe.
{
"name": "<name>"
}Responses
- messagestring
Greeting, e.g. "hello, catapult" — or "hello, world" when no name was sent.
- apiVersionstring
The contract version this server is serving, e.g. "0.1.0-draft".
About Management
The OneTablet Management API — the partner-facing contract for operators and the systems acting on their behalf.
All endpoints are POST with a single JSON body, which is webpieces' shape and also, not by coincidence, the shape the published spec already commits to: its 25 operations are all verb-first POSTs (/fetchOrders, /pauseStores, /setItemAvailability).
The base path carries NO version segment. Contract evolution here is additive — new fields and new endpoints, never removals or narrowing (ONE-2596) — so there is no cutover a /v1 would ever mark, and a version in the path only becomes a number nobody can retire.
It does NOT sit under public-api's NestJS api global prefix: the webpieces router binds to the raw express app (bindExpress), below Nest's prefix and versioning, so these routes and the existing /api/v1/orders/* REST routes cannot collide.
Right now it carries ONE endpoint on purpose. helloWorld exists to prove the side-by-side mount inside public-api and the code-to-docs pipeline end to end, and is to be REMOVED once a real Phase 0 operation (fetchOrders) lands.
AUTH (ONE-2625): @AuthApiKey(MANAGEMENT_API_KEY_REGIME, MANAGEMENT_API_KEY_CREDENTIALS) — a CUSTOMER-held key, not an internal service credential (see AuthApiKey's own doc comment for why this is NOT @AuthSharedSecret: a partner is not a peer service, and the mode sits on the caller-NOT-verified side so a forwarded trusted header must still be independently re-derived). public-api's ManagementApiKeyHook resolves the key to its owning organization via the SAME lookup OrganizationMiddleware already uses for the legacy REST routes (OrganizationWebhookRepository.findOrganizationIdByApiKey), and stamps the result as OneTabletKey.ORG_ID. helloWorld itself still reads nothing derived from the resolved identity — it stays a liveness probe, now merely an AUTHENTICATED one.