Documentation menu

Child records (carbon sources)

Per-event carbon-source child records (shared CRUD contract). Authorization: any member of the owning organization (admin/manager/user) OR a supplier assigned to the event may read and write these records — unlike event management, which is manager+. Suppliers are confined to their own rows, EXCEPT on activity, product, service (these types have no supplierId column, so a supplier assigned to the event can read and write every row of the type). The submit/review/approve workflow exists only on types with workflow columns — not on transport-overseas, activity, product, service. Ownership (eventId/supplierId), workflow flags (reviewed/submitted/approved/feedback) and timestamps are server-controlled.

The shared contract

Every record type lives at /events/{eventId}/<type> with identical operations: list, create, get, update, delete — plus submit/review/approve on workflow-capable types. The operations below use flights as the exemplar; substitute any type slug from the matrix.

GET/events/{eventId}/flights

List flights records for an event

Parameters

NameInTypeRequiredDescription
eventIdpathstringrequiredObjectId of the parent event in the path.
X-Organization-IdheaderstringoptionalTarget organization ObjectId; required for APP_ADMIN and SUPPLIER callers and ignored (must match the caller's own org) for org admins, managers, and users.
pagequeryintegeroptionalPage number to retrieve (1-based); integer, minimum 1, defaults to 1.
limitqueryintegeroptionalPage size (number of records per page); integer, minimum 1, maximum 100, defaults to 25.

Responses

  • 200Paginated records.
  • 400Request body/params failed validation.
  • 401Missing/invalid token.
  • 403Authenticated but not allowed (role or cross-org).
  • 404Not found (or not in the caller's org).
POST/events/{eventId}/flights

Create a flights record

Parameters

NameInTypeRequiredDescription
eventIdpathstringrequiredObjectId of the parent event in the path.
X-Organization-IdheaderstringoptionalTarget organization ObjectId; required for APP_ADMIN and SUPPLIER callers and ignored (must match the caller's own org) for org admins, managers, and users.

Request body ChildInput (required, application/json)

Responses

  • 201Created record.
  • 400Request body/params failed validation.
  • 401Missing/invalid token.
  • 403Authenticated but not allowed (role or cross-org).
  • 404Not found (or not in the caller's org).
  • 429Rate limit exceeded.
GET/events/{eventId}/flights/{recordId}

Get a flights record

Parameters

NameInTypeRequiredDescription
eventIdpathstringrequiredObjectId of the parent event in the path.
recordIdpathstringrequiredObjectId of the per-event carbon-source child record in the path.
X-Organization-IdheaderstringoptionalTarget organization ObjectId; required for APP_ADMIN and SUPPLIER callers and ignored (must match the caller's own org) for org admins, managers, and users.

Responses

  • 200The record.
  • 400Request body/params failed validation.
  • 401Missing/invalid token.
  • 403Authenticated but not allowed (role or cross-org).
  • 404Not found (or not in the caller's org).
PATCH/events/{eventId}/flights/{recordId}

Update a flights record

Parameters

NameInTypeRequiredDescription
eventIdpathstringrequiredObjectId of the parent event in the path.
recordIdpathstringrequiredObjectId of the per-event carbon-source child record in the path.
X-Organization-IdheaderstringoptionalTarget organization ObjectId; required for APP_ADMIN and SUPPLIER callers and ignored (must match the caller's own org) for org admins, managers, and users.

Request body ChildInput (required, application/json)

Responses

  • 200Updated record.
  • 400Request body/params failed validation.
  • 401Missing/invalid token.
  • 403Authenticated but not allowed (role or cross-org).
  • 404Not found (or not in the caller's org).
  • 429Rate limit exceeded.
DELETE/events/{eventId}/flights/{recordId}

Delete a flights record

Parameters

NameInTypeRequiredDescription
eventIdpathstringrequiredObjectId of the parent event in the path.
recordIdpathstringrequiredObjectId of the per-event carbon-source child record in the path.
X-Organization-IdheaderstringoptionalTarget organization ObjectId; required for APP_ADMIN and SUPPLIER callers and ignored (must match the caller's own org) for org admins, managers, and users.

Responses

  • 204Deleted.
  • 400Request body/params failed validation.
  • 401Missing/invalid token.
  • 403Authenticated but not allowed (role or cross-org).
  • 404Not found (or not in the caller's org).
  • 429Rate limit exceeded.
POST/events/{eventId}/flights/{recordId}/submit

Submit a flights record for review (supplier/member; sets submitted)

Parameters

NameInTypeRequiredDescription
eventIdpathstringrequiredObjectId of the parent event in the path.
recordIdpathstringrequiredObjectId of the per-event carbon-source child record in the path.
X-Organization-IdheaderstringoptionalTarget organization ObjectId; required for APP_ADMIN and SUPPLIER callers and ignored (must match the caller's own org) for org admins, managers, and users.

Responses

  • 200Updated record.
  • 400Request body/params failed validation.
  • 401Missing/invalid token.
  • 403Authenticated but not allowed (role or cross-org).
  • 404Not found (or not in the caller's org).
  • 429Rate limit exceeded.
POST/events/{eventId}/flights/{recordId}/review

Review a flights record (managers+; sets reviewed + feedback)

Parameters

NameInTypeRequiredDescription
eventIdpathstringrequiredObjectId of the parent event in the path.
recordIdpathstringrequiredObjectId of the per-event carbon-source child record in the path.
X-Organization-IdheaderstringoptionalTarget organization ObjectId; required for APP_ADMIN and SUPPLIER callers and ignored (must match the caller's own org) for org admins, managers, and users.

Request body object (optional, application/json)

Responses

  • 200Updated record.
  • 400Request body/params failed validation.
  • 401Missing/invalid token.
  • 403Authenticated but not allowed (role or cross-org).
  • 404Not found (or not in the caller's org).
  • 429Rate limit exceeded.
POST/events/{eventId}/flights/{recordId}/approve

Approve a flights record (managers+; sets approved)

Parameters

NameInTypeRequiredDescription
eventIdpathstringrequiredObjectId of the parent event in the path.
recordIdpathstringrequiredObjectId of the per-event carbon-source child record in the path.
X-Organization-IdheaderstringoptionalTarget organization ObjectId; required for APP_ADMIN and SUPPLIER callers and ignored (must match the caller's own org) for org admins, managers, and users.

Responses

  • 200Updated record.
  • 400Request body/params failed validation.
  • 401Missing/invalid token.
  • 403Authenticated but not allowed (role or cross-org).
  • 404Not found (or not in the caller's org).
  • 429Rate limit exceeded.

All 16 record types

Type slugWorkflow (submit/review/approve)Supplier rows pinned
accommodation✓✓
flights✓✓
travel✓✓
transport✓✓
transport-overseas— (transitions 404)✓
private-jets✓✓
activity— (transitions 404)shared across suppliers
food-beverage✓✓
drinks✓✓
venue✓✓
virtual✓✓
waste✓✓
printed-materials✓✓
production-items✓✓
product— (transitions 404)shared across suppliers
service— (transitions 404)shared across suppliers

ChildRecord schema (common fields)

A per-event child record. Common fields below; resource-specific fields vary by child type.

FieldTypeRequiredDescription
_idstringoptionalServer-generated MongoDB ObjectId uniquely identifying this carbon-source record; read-only.
eventIdstringoptionalObjectId of the event this carbon-source record belongs to, inherited from the parent route and stamped server-side; read-only and ignored if sent.
supplierIdstringoptionalObjectId of the supplier User pinned to this row, set server-side when a supplier creates it and null until a supplier is assigned; read-only and ignored if sent.
reviewedbooleanoptionalServer-controlled workflow flag set true by the manager `review` transition when the event team reviews the row and leaves feedback; read-only and ignored if sent.
submittedbooleanoptionalServer-controlled workflow flag set true by the `submit` transition when a supplier or member hands the row off for the event team's review; read-only and ignored if sent.
approvedbooleanoptionalServer-controlled workflow flag set true by the manager `approve` transition; only approved rows are counted in the event's carbon calculation; read-only and ignored if sent.
feedbackstringoptionalManager's free-text review comments shared with the supplier, set by the `review` transition and shown to suppliers as event-team feedback; read-only and ignored on create/update.
createdAtstring (date-time)optionalServer-generated timestamp of when the record was created; read-only.
updatedAtstring (date-time)optionalServer-generated timestamp of the record's last modification; read-only.
Type-specific fields: Each type carries additional fields specific to its carbon source (e.g. flight class and passenger counts, venue energy figures). The API accepts them as part of the create/update body (ChildInput); formal per-type field documentation is in progress — until then, mirror the fields shown in the EventZero app for the type.