Core Backend — how to build (recommended usage)

How to use existing Core Backend and APIs for this PMS. Not a request to add hotel-specific Laravel modules. Nellalink writes the supported Laravel Package

Explorer: https://backend-dev.bookdirect.live/public/docs/api#/

Do use (already in Core Backend)

Need	Winner URL
Register	POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/register
Login	POST https://backend-dev.bookdirect.live/public/api/v1/nellalink/user/login
Refresh / logout	POST .../user/refresh, POST .../user/logout
Create / list / get / update entity	.../smart-meta-manager/entity/{type}
Metadata	POST/PUT .../meta-data/entity/{type}/{uuid}
Tags / categories catalog	POST .../tag, POST .../category — also tags[] / categories[] on entity create/update
Staff on a property	PUT .../role/entity/property/{property_uuid}/{user_uuid}
Outbound webhooks (if host configured)	Core Backend EVENT_WEBHOOK_URL — Middleware Backend consumes; Core Backend does not call Paystack

Full cards: Auth, Entities, Metadata.

Recommended conventions (docs only)

1. Entity types: property, room, rate_plan, inventory (optional), booking, payment. First POST creates nll_{type}.
2. property_category metadata: hotel | shortlet | apartment. One PMS list for owners.
3. Booking parent: rate_plan when sold by unit (hotel / apartment units); property when sold as a whole (shortlet / whole apartment).
4. Two API keys. Public browse key (in the Vue app): GET active property / room / rate_plan only. Write key (JWT required): creates/updates. Configure with allowed_request_api_url_path_settings and require_user_bearer_token. If path settings cannot do this yet, recommend adding them on Core Backend — do not assign IDOR to frontend. Full table: Security and IDOR.
5. owned_by on create must match the JWT (Core Backend enforces). request_id unique per create.
6. extra_data on PUT replaces the whole object — always send the full JSON.
7. Object ACL on GET/PUT/DELETE .../entity/{type}/{uuid} — if a public key can read booking/payment, that is a Core Backend path-settings gap.

Do not add to Core Backend

Do not	Where it belongs
Paystack / Squad / Tsara capture or refund	Middleware Backend payments / refunds
Resend / SMTP booking templates	Middleware Backend emails
GuestTraction / Google Hotel ARI	Middleware Backend google-rates
Date-overlap availability engine	Middleware Backend availability
nll_hotel, nll_shortlet, nll_apartment	Use property + property_category
Booking workflow beyond status + extra_data	Frontend + Middleware Backend; Core Backend stays generic
Scrapers, Zoho, Convex crons	Out of Core Backend; workers in Middleware Backend if needed

If a product need looks like “Core Backend should call Google,” it is a Middleware Backend folder. Frontend then calls Middleware Backend; Middleware Backend writes Core Backend.