mein-plakat API (1.0.0)

Retrieves all API permissions (scopes) from all resource servers in Auth0.

Creates a new permission (scope) on a resource server.

Deletes a permission (scope) from a resource server.

Retrieves the entire watchlist for the currently logged-in user.

Adds a location to the user's watchlist.

Removes a location from the user's watchlist.

Checks if a specific location is in the user's watchlist.

Retrieves the profile of the currently logged-in user.

Updates the profile of the currently logged-in user.

Sends a password reset email to the logged-in user.

Uploads a profile picture for the logged-in user (Multipart/form-data).

Creates a ticket in the Simple Support System (project mein_plakat).

Imports SDAW records from a file (text content).

Extracts column headers from uploaded schedule file for mapping. Admin permission required.

Imports schedule (Terminplan) data from Excel/CSV with field mapping. Replaces only business years present in file. Admin permission required.

Generates a temporary CloudFront signed URL for a private file (admin only).

Extracts column headers from uploaded Excel file for mapping (admin only).

Imports municipality directory data from Excel file with field mapping (admin only).

Returns pre-computed location coverage statistics (tiles, fiscal year data). Admin permission required.

Returns paginated list of locations missing data for a given coverage metric. Admin permission required.

Execute GraphQL queries and mutations against the mein-plakat API.

Available Queries:

• checkPermissions - Check if current user has admin permissions
• locationPhotos(page, limit, districtId, providerId) - Get location photos with pagination
• locationPhoto(id) - Get a single location photo by ID
• consumerMarketPhotos(page, limit, consumerMarketId, providerId) - Get consumer market photos with pagination
• consumerMarketPhoto(id) - Get a single consumer market photo by ID
• logs(page, limit, app, level) - Get logs with pagination
• sdawBaseRecords(type, page, limit) - Get SDAW base records (filtered by type)
• sdawBaseRecord(id, type) - Get a single SDAW base record
• sdawDetailRecords(baseId, type, collectionSuffix, page, limit) - Get SDAW detail metadata (actual data from S3 via REST)
• importStats - Get overall import statistics
• users(page, limit, sortBy, sortOrder) - Get users with pagination
• receivedEmails(page, limit, sortBy, sortOrder) - Get received emails with pagination
• sentEmails(page, limit, sortBy, sortOrder) - Get sent emails with pagination
• combinedAdvertisingMedia(...) - Werbeträger merged locations (filterChain, counterSnapshots, optional extended PpS metrics)
• advertisingMediaFilterContext(...) - Candidate row count; optional PpS bounds and population min/max (prefix chain, scan-capped)
• geoRadiusMunicipalityPreview(addressLine, radiusKm) - Geocode center + municipalities with location counts inside radius (Nominatim + scan)

Example Query:

query {
  locationPhotos(page: 1, limit: 10) {
    items {
      _id
      districtId
      providerId
      originalPath
      variants { size type path }
    }
    pageInfo { total hasNextPage }
  }
}

Hands back everything the browser needs to put a file into the private files bucket by itself (admin only). Up to 64 MB that is one signed PUT; above it the answer carries the part URLs of a multipart upload instead, so gigabyte print data survives a broken line. Report the result to /v1/uploads/complete afterwards, that is where size and checksum are read off the stored object.

Closes a multipart upload when parts were used and then reads size, content type and checksum off the stored object (admin only). Nothing here is taken from the caller: a file over the limit of its scope or of a type the scope does not accept is deleted again right away, because at that point it already lies in the bucket.

Removes the parts of an unfinished multipart upload (admin only). Until it is completed no object exists under the key at all, so an upload that breaks off leaves no half file behind; this only makes sure the orphaned parts are not billed until the bucket rule clears them.

Removes a file from the private files bucket (admin only).

Creates an async export job. Returns immediately with jobId. SIS process-exports task picks up pending jobs and generates the file. Admin permission required.

Returns all MongoDB collections with document count. Admin permission required.

Returns paginated documents from a collection. Supports search. Admin permission required.

Returns AWS Cost Explorer data (current month costs, estimated month-end, past 12 months). Cached for 1 hour. Admin permission required.

Returns total Auth0 user count. Cached 1 hour. Admin permission required.

Returns the full decoded SDAW JSON for a given file UUID. The UUID corresponds to the S3 key sdaw/{uuid}.json.

Returns filter options for objectTypes and illuminations. No authentication required. Used by the Site app for dynamic filter loading.

Returns the closest MunicipalityDirectory entries to the given lat/lng (deduped by AGS). With useIp=1 and no lat/lng, resolves approximate coordinates from the caller IP: optional local GeoIP2-compatible local City MMDB e.g. DB-IP Lite (GEOIP_CITY_MMDB_PATH), then HTTPS ipwho.is. Loopback IPs use GEOIP_DEV_FALLBACK_* if set.

Returns a GeoJSON FeatureCollection of municipality (8-digit AGS) and/or Kreis (5-digit) outlines for the requested codes. Unknown codes are skipped. No authentication required.

Returns detailed information for an advertising location identified by its slug. Includes free booking terms (only periods whose end date is on or after today, Europe/Berlin), image variants, and core location data.

Alternative to slug lookup. Returns the same location details (free terms, image info) when identified by providerId, locationNumber, and positionNumber. IDs are parsed as integers.

Returns the health status of the API service

Returns all attachments for a given email template (admin only).

Uploads a file attachment for an email template. The file is stored in S3 and metadata is saved in the template document (admin only).

Deletes a file attachment from an email template. Removes the file from S3 and the metadata from the template document (admin only).

Resolves the token of an approval mail to the whole changed order, not just to the list of changes: positions, sales articles, what changed and the price effect. The token only names the request; the login decides who may see it, so a stranger with the link gets nothing.

The customer confirms the changed order. The request is logged with the moment and the person, and the order moves to "Freigabe erteilt" (5.2.9). Nothing is sent from here.

The motif behind the upload link of the customer interaction (5.4.2), with the request that was sent and whether the link is still open. It closes as soon as a newer version arrived in the meantime, otherwise the customer would overwrite the newer state.

Behind the login, never on an open token (your ruling of 13.08.2026). The link closes as soon as a newer version arrived in the meantime. The same file again is not a new version: the checksum of the stored object decides that, the same rule as in the admin (5.4.2).

Print data for posters runs into gigabytes and never goes through the Lambda: the browser gets a signed URL and puts the file into the bucket itself. The link is checked here as well, so a closed one hands out no URL in the first place.

Resolves the cart to poster formats over the assignment table, builds the offer of sales articles per format out of the article master (checkout role, display condition, option groups) and prices it with the dated price rows of the customer group. Also returns the open projects the order may be attached to, the invoice addresses and the print files already staged.

Writes the order, its booked positions, the motifs the choice implies and the sales articles that hang on no motif, then authorizes the payment. Nothing is charged and no mail goes out. A booking spanning two business years is split right here.

Print data for posters runs from hundreds of megabytes into gigabytes, so it never goes through the Lambda: the browser gets a signed URL, puts the file into the bucket itself and hands back only the key. The content type is part of the signature.

A motif hangs on a project and may never move between projects, so a file the customer brings in the checkout is parked until it can be assigned. Size and checksum are read off the stored object, not off what the caller claims.

Only a file that is still waiting can be dropped; once it became a motif version it belongs to the project.

Returns the current user's cart lines with optional term alternatives per line. Enriched with municipalityNameSnapshot, districtSnapshot, and thumbnailUrl (location photo) when available.

Adds a bookable term as a cart line. Duplicate provider/location/position/termin returns 409.