Route Surfaces
| Route group | Audience | Access model |
|---|---|---|
| Public | Prospects, customers, public visitors | Public pages with no private operational records. |
| Tenant admin | Tenant staff and admins | Staff authentication, tenant membership, permissions, branch scope, and module readiness. |
| Customer portal | Customer | First-party customer session and ownership checks. |
| Fleet portal | Fleet Admin and Driver | Clerk-protected Ignition workspace; Fleet Admin is company/account scoped, Driver is active-assignment scoped, and all readiness/ownership/action checks remain server-side. |
| Token public | Customer payment or feedback recipient | Opaque token or payment-link checks with customer-safe payloads. A payment link keeps its credential in the opening tab, reads only an unexpired pending/processing request, and makes terminal or expired links fail safely. |
The public homepage may render only its disclosed static synthetic vehicle, queue, job, approval, and invoice illustrations; none comes from a tenant system or represents live tenant state. Every real tenant, Platform, customer, Fleet, and token-public route remains fixture-free and must be protected or API-backed according to its access model.
Customer portal routes include the portal home, Garage at /t/{tenantSlug}/portal/vehicles, vehicle
detail and vehicle-specific history below that route, cross-vehicle History at
/t/{tenantSlug}/portal/history, the durable inbox at
/t/{tenantSlug}/portal/notifications, invoices, booking intake, the booking list/detail below
/t/{tenantSlug}/portal/bookings, paginated active work at /t/{tenantSlug}/portal/services, and
the pending decision queue at /t/{tenantSlug}/portal/approvals. The mobile navigation intentionally
keeps five primary destinations—Home, Book, Garage, History, and Profile—while Home provides direct
links to Services, Approvals, and Invoices. All require the
first-party customer session and current ownership where a vehicle is addressed. The notification
route uses only the signed-in customer’s self-inbox; it never accepts a recipient or audience
selector. Every route uses the Ignition customer shell; there is no presentation selector or retired
shell fallback.
Customer service detail below /t/{tenantSlug}/portal/repair-orders/{repairOrderId} includes the
customer-safe inspection-report state for the latest submitted inspection. Download is a revalidated
server action that issues a short-lived private link only when ownership, repair-order binding,
inspection binding, readiness, and current artifact state still pass. A report failure does not hide
the rest of the service detail.
Customer invoice routes are /t/{tenantSlug}/portal/invoices, invoice detail below that route, and
the exact authenticated result route
/t/{tenantSlug}/portal/invoices/{invoiceId}/payment-requests/{paymentRequestId}/result. Result pages
read saved backend state only; provider return parameters are not status.
The home balance uses the protected outstanding-summary contract, groups totals by currency, and
scopes every included invoice to the signed-in customer and a vehicle they currently own.
Staff appointment routes are /t/{tenantSlug}/admin/appointments, its protected appointment detail,
and /t/{tenantSlug}/admin/calendar. All three use complete Ignition chrome. Tenant membership,
permissions, branch scope, workflow transitions, and readiness remain protected-API decisions.
Staff customer and vehicle routes are /t/{tenantSlug}/admin/customers,
/t/{tenantSlug}/admin/customers/{tenantCustomerId}, /t/{tenantSlug}/admin/vehicles, and
/t/{tenantSlug}/admin/vehicles/{vehicleId}. They share one Ignition workspace model. Internal IDs
remain protected navigation and action transport; the visible
identity is the customer contact or vehicle plate. Owner search is bounded and server-authorized,
and customer, owner, or document failures remain local to their section.
Fleet routes below are relative to /t/{tenantSlug}/fleet/accounts/{fleetAccountId} and include
the usual locale prefix. Each requires the correct external role for that exact account.
| Route | Role and purpose |
|---|---|
/ | Fleet Admin overview with bounded previews and links to complete lists. |
/approvals | Fleet Admin’s complete paginated queue of assigned requests awaiting decision. |
/approvals/{requestId} | Fleet Admin’s visible estimate review and explicit decision confirmation. |
/service-history | Fleet Admin’s paginated company service history, with vehicle, status and date filters. |
/service-history?scope=active | Fleet Admin’s complete active work view. |
/billing | Fleet Admin’s paginated prepared monthly statements. |
/billing/{runId} | Fleet Admin’s statement total and included service details. |
/driver/service-history | Driver’s current assignments and filtered service history. |
/driver/service-history?scope=active | Driver’s active work for currently assigned vehicles. |
Driver routes exclude approvals, credit and billing. Fleet routes do not provide self-service bookings, vehicle links or Driver assignment management. Account and record identifiers remain in protected links and actions; users identify work by company, vehicle plate and Repair Order number. See External Fleet workspace.