DevelopersTablet version · pilot
Develop with the Kelna API
Understand the HTTP contracts used by the application and the current foundation’s limits.
Current scope
This reference describes the internal API of the tablet, pass and console application. It is not yet a stable partner integration offering. There are no partner API keys, partner OAuth flows or public webhooks.
Room routes use a paired device. Organization routes use a human session with MFA and venue permissions. The documentation is static: it receives no application cookie and provides no connected request console.
Origin and transport
The test application’s origin is https://app.kelna.fr; paths begin with /api. Locally, use the frontend origin and its API proxy. The fetch examples assume an authorized client running on that same origin, not on docs.kelna.fr.
Writes require an Origin header matching the configured origin exactly, plus the expected identity. JSON requests have a maximum size of 64 KiB. No public CORS access is provided. API responses carry Cache-Control: no-store.
curl https://app.kelna.fr/api/health
# {"status":"ok"}Organizations and permissions
An organization contains venues. An organization path grants no rights by itself: the server checks membership, permissions and PostgreSQL isolation. A device identity belongs to one venue.
Checks use permission codes such as venue.view, devices.manage, tables.update and tables.join, never a role name. Role assignment prevents escalation and removal of the last Owner.
Processed data
Events concern tables, their states and timestamps. No staff name or identifier may be added to commands. No documented endpoint accepts images or video.
Camera configuration remains experimental. It does not connect presence observations to the current service.
Need a hand?
Describe the step that failed and the message shown. Keep passwords and sign-in codes private.
Contact the Kelna team