Diary entries

Edit is not available via the API

Editing a diary entry stays in the app; this verb is answered with a `405` pointing there.

PUT
/diary-entries

Editing a diary entry stays in the app; this verb is answered with a 405 pointing there.

Authorization

x-api-key<token>

The per-tenant API key, copied from Settings → API & integrations. Sent as the x-api-key request header. The key is tenant-scoped and acts with Admin-equivalent, tenant-wide access.

In: header

Response Body

application/json

curl -X PUT "https://example.com/diary-entries"
{  "error": {    "code": "method_not_allowed",    "message": "This resource is read-only via the API. Edit it in the FOREMAN app."  }}

List diary entries GET

Lists diary entries, most-recent-first, paginated. Filters map onto the domain browse: `projectId` and `userId` are repeatable. An API key is **Admin-equivalent and tenant-wide**, so this returns every entry in the tenant. The narrower per-role visibility introduced by SUP-449 — a Site Manager sees their sites plus their own, Site Crew only their own — applies to signed-in users of the web app; there is no crew-scoped API credential. **This read closes expired shifts before it answers** (ADR 0012, amended): open shifts past 12 hours inside the read's scope are auto-closed first, so the list can contain entries created by this very call — `origin` `auto_closed`, `createdBy` null, `durationMinutes`/`hours` **null** (hours *missing*, never 0, zero in totals), `closedAutomaticallyReason` `12h`. An hourly database job runs the same sweep whether or not anyone reads, so the entries exist before they are asked for. Writes never sweep.

Request a presigned diary-photo upload URL POST

**Step 1 of the presigned diary-photo upload** — the image-only sibling of the document upload. Validates the declared image (JPG/PNG only — no PDF) and returns a short-lived, single-use **signed PUT URL** (`uploadUrl`) plus the computed `storagePath`. **The image bytes never travel through this API call.** After this returns, the caller PUTs the raw image bytes directly to `uploadUrl` (a plain HTTP `PUT` with the file as the request body and the matching `Content-Type`) — out of band — then passes the returned `storagePath` in the `photoPaths` array of `POST /diary-entries`. **There is no register step**: creating the diary entry writes the `diary_photo` row(s) (ADR 0001 §5). Any crew member assigned to the project may log diary photos (not manager-only); an Admin/API key is implicitly on every project. Blocked on read-only/archived projects. **Photos must be 2 MB or smaller.** The limit is enforced by Storage on the PUT itself, so an oversized upload fails at that step rather than here — this call only sees the *declared* file. Resize before uploading: 1600px on the long edge is plenty, and is what the FOREMAN app sends.