Middleware Backend — Properties

Folder: src/routes/properties/
Mount: api/v1/nellalink/properties
Status: live (explorer + routes.json). Writes Core property.

Middleware Backend · winnerimplemented

POST https://middleware-dev.bookdirect.live/api/v1/nellalink/properties

GET https://middleware-dev.bookdirect.live/api/v1/nellalink/properties

GET https://middleware-dev.bookdirect.live/api/v1/nellalink/properties/mine

GET https://middleware-dev.bookdirect.live/api/v1/nellalink/properties/{id}

PUT https://middleware-dev.bookdirect.live/api/v1/nellalink/properties/{id}

DELETE https://middleware-dev.bookdirect.live/api/v1/nellalink/properties/{id}

Create body: name, address, city, country required. Optional propertyType, amenities[] (slugs, see tick list), images[] (URLs from file-manager).

owned_by comes from JWT — never from the client body.

On write, persist Core indexes: category, city metadata, amenity_{slug} meta + tags, optional location_city_{slug} / policy_* tag mirrors. Do not listAll every property for Marketplace search.

Core narrow (Middleware → Core)

City AND one amenity AND type. tags=a,b is OR — do not put city and amenity on the same tags=. Full table: Search indexes.

GET https://backend-dev.bookdirect.live/public/api/v1/nellalink/smart-meta-manager/entity/property?search=Lagos&search_by=meta_key.city&tags=amenity_swimming_pool&categories=hotel&meta_key_to_retrieve=city,min_rate_ngn,amenity_swimming_pool,amenity_free_parking&per_page=20&page=1

curl -sS -G 'https://backend-dev.bookdirect.live/public/api/v1/nellalink/smart-meta-manager/entity/property' \
  --data-urlencode 'search=Lagos' \
  --data-urlencode 'search_by=meta_key.city' \
  --data-urlencode 'tags=amenity_swimming_pool' \
  --data-urlencode 'categories=hotel' \
  --data-urlencode 'per_page=20' \
  -H 'Accept: application/json' \
  -H 'x-api-key: {ROUTE_FILE_MANAGER_X_API_KEY_CORE_BACKEND}'

Same fetchAll: https://backend-test.nellalink.com/public/docs/api#/operations/fetchEntities.fetchAll.

Then AND extra amenity slugs, price (min_rate_ngn), dates/rooms (availability), guests vs maxOccupancy.

Frontend: Onboarding, Marketplace and Search.

IDOR: public GET lists active only. PUT/DELETE require owner (or Core role). Recommend Core path deny for public-key booking reads still.

Triggered from: Extranet create/edit property, Marketplace listing.