> ## Documentation Index
> Fetch the complete documentation index at: https://docs.readingsteps.uk/llms.txt
> Use this file to discover all available pages before exploring further.

# Library API

> Server endpoints for the ReadingSteps library system.

# Library API

All library API routes except the public catalog require a valid Supabase access token in the `Authorization: Bearer <token>` header.

## Authentication

Librarians sign in through the shared staff login page. The login POSTs credentials to `/api/auth/login`, which sets `sb-access-token` and `sb-refresh-token` cookies and returns a redirect URL. The cookies are then sent automatically with subsequent requests.

## Routes

### `POST /api/auth/login`

Signs in a staff member or librarian.

**Request body**

```json theme={null}
{
  "email": "string",
  "password": "string"
}
```

**Response**

```json theme={null}
{
  "redirect": "/library/<school-domain>"
}
```

Sets `sb-access-token` and `sb-refresh-token` cookies.

***

### `GET /api/library/catalog/<domain>`

Public catalog for a school. Does not require authentication.

**Response**

```json theme={null}
{
  "school": { "id": "uuid", "name": "string", "domain": "string" },
  "settings": { "default_loan_days": 14, "max_renewals": 2, "renewal_days": 7 },
  "books": [
    { "id": "uuid", "isbn": "string", "title": "string", "author": "string", "cover_url": "string", "total_copies": 10, "available_copies": 7 }
  ]
}
```

***

### `GET /api/library/accounts?schoolId=<uuid>`

List librarian accounts for a school. Requires admin or staff token.

***

### `POST /api/library/invite`

Create a new librarian account. Requires admin token.

**Request body**

```json theme={null}
{
  "email": "string",
  "school_id": "uuid",
  "password": "string (optional)"
}
```

***

### `PATCH /api/library/accounts/manage`

Suspend or unsuspend a librarian account. Requires admin token.

**Request body**

```json theme={null}
{
  "account_id": "uuid",
  "suspended": "boolean"
}
```

***

### `POST /api/library/books`

Add a book to the catalog. Requires librarian token.

**Request body**

```json theme={null}
{
  "school_id": "uuid",
  "isbn": "string (optional)",
  "title": "string",
  "author": "string",
  "copies": 5
}
```

***

### `POST /api/library/copies`

Generate copy codes for a book. Requires librarian token.

**Request body**

```json theme={null}
{
  "book_id": "uuid",
  "count": 5
}
```

***

### `GET /api/library/loans`

List active loans for the librarian's school.

### `POST /api/library/loans`

Create a loan. Requires librarian token.

**Request body**

```json theme={null}
{
  "book_id": "uuid",
  "copy_id": "uuid",
  "student_id": "uuid",
  "due_at": "ISO date"
}
```

### `PATCH /api/library/loans`

Renew or return a loan. Requires librarian token.

**Request body**

```json theme={null}
{
  "loan_id": "uuid",
  "action": "renew" | "return"
}
```

***

### `GET /api/library/settings`

Read settings for the librarian's school.

### `PUT /api/library/settings`

Update settings. Requires librarian token.

**Request body**

```json theme={null}
{
  "default_loan_days": 14,
  "max_renewals": 2,
  "renewal_days": 7,
  "allow_public_catalog": true
}
```

***

### `GET /api/library/student/loans`

Returns the currently authenticated student's loans.