curl --request POST \
--url https://api.nexspace365.com/api/facilities \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"name": "<string>",
"type": "<string>",
"address": "<string>",
"city": "<string>",
"state": "<string>",
"zip": "<string>",
"phone": "<string>",
"email": "jsmith@example.com",
"website": "<string>",
"licenseNumber": "<string>",
"bedCount": 123
}
'import requests
url = "https://api.nexspace365.com/api/facilities"
payload = {
"name": "<string>",
"type": "<string>",
"address": "<string>",
"city": "<string>",
"state": "<string>",
"zip": "<string>",
"phone": "<string>",
"email": "jsmith@example.com",
"website": "<string>",
"licenseNumber": "<string>",
"bedCount": 123
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
name: '<string>',
type: '<string>',
address: '<string>',
city: '<string>',
state: '<string>',
zip: '<string>',
phone: '<string>',
email: 'jsmith@example.com',
website: '<string>',
licenseNumber: '<string>',
bedCount: 123
})
};
fetch('https://api.nexspace365.com/api/facilities', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.nexspace365.com/api/facilities",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => '<string>',
'type' => '<string>',
'address' => '<string>',
'city' => '<string>',
'state' => '<string>',
'zip' => '<string>',
'phone' => '<string>',
'email' => 'jsmith@example.com',
'website' => '<string>',
'licenseNumber' => '<string>',
'bedCount' => 123
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.nexspace365.com/api/facilities"
payload := strings.NewReader("{\n \"name\": \"<string>\",\n \"type\": \"<string>\",\n \"address\": \"<string>\",\n \"city\": \"<string>\",\n \"state\": \"<string>\",\n \"zip\": \"<string>\",\n \"phone\": \"<string>\",\n \"email\": \"jsmith@example.com\",\n \"website\": \"<string>\",\n \"licenseNumber\": \"<string>\",\n \"bedCount\": 123\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.nexspace365.com/api/facilities")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"<string>\",\n \"type\": \"<string>\",\n \"address\": \"<string>\",\n \"city\": \"<string>\",\n \"state\": \"<string>\",\n \"zip\": \"<string>\",\n \"phone\": \"<string>\",\n \"email\": \"jsmith@example.com\",\n \"website\": \"<string>\",\n \"licenseNumber\": \"<string>\",\n \"bedCount\": 123\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.nexspace365.com/api/facilities")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"<string>\",\n \"type\": \"<string>\",\n \"address\": \"<string>\",\n \"city\": \"<string>\",\n \"state\": \"<string>\",\n \"zip\": \"<string>\",\n \"phone\": \"<string>\",\n \"email\": \"jsmith@example.com\",\n \"website\": \"<string>\",\n \"licenseNumber\": \"<string>\",\n \"bedCount\": 123\n}"
response = http.request(request)
puts response.read_body{
"id": 1,
"name": "Downtown Distribution Center",
"type": "warehouse",
"address": "500 Industrial Pkwy",
"city": "Columbus",
"state": "OH",
"zip": "43004",
"phone": "+1-614-555-0142",
"email": "ops@acme.example.com",
"website": "https://acme.example.com",
"licenseNumber": null,
"bedCount": null,
"departments": [
"Receiving",
"Fulfillment",
"Shipping"
],
"isActive": true,
"createdAt": "2026-01-15T09:00:00Z",
"updatedAt": "2026-05-02T14:30:00Z"
}{
"error": {
"message": "<string>",
"code": "<string>",
"details": {},
"suggestion": "<string>",
"retryable": true
},
"requestId": "<string>"
}{
"error": {
"message": "<string>",
"code": "<string>",
"details": {},
"suggestion": "<string>",
"retryable": true
},
"requestId": "<string>"
}Create new facility
Create a new facility (super admin only). The guard is authorize(ROLES.SUPER_ADMIN), which reads req.user.role — and API-key authentication hydrates req.user from the key’s owner — so a key owned by a super admin is admitted, not just a session/JWT. There is no scope check on this route.
curl --request POST \
--url https://api.nexspace365.com/api/facilities \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"name": "<string>",
"type": "<string>",
"address": "<string>",
"city": "<string>",
"state": "<string>",
"zip": "<string>",
"phone": "<string>",
"email": "jsmith@example.com",
"website": "<string>",
"licenseNumber": "<string>",
"bedCount": 123
}
'import requests
url = "https://api.nexspace365.com/api/facilities"
payload = {
"name": "<string>",
"type": "<string>",
"address": "<string>",
"city": "<string>",
"state": "<string>",
"zip": "<string>",
"phone": "<string>",
"email": "jsmith@example.com",
"website": "<string>",
"licenseNumber": "<string>",
"bedCount": 123
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
name: '<string>',
type: '<string>',
address: '<string>',
city: '<string>',
state: '<string>',
zip: '<string>',
phone: '<string>',
email: 'jsmith@example.com',
website: '<string>',
licenseNumber: '<string>',
bedCount: 123
})
};
fetch('https://api.nexspace365.com/api/facilities', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.nexspace365.com/api/facilities",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => '<string>',
'type' => '<string>',
'address' => '<string>',
'city' => '<string>',
'state' => '<string>',
'zip' => '<string>',
'phone' => '<string>',
'email' => 'jsmith@example.com',
'website' => '<string>',
'licenseNumber' => '<string>',
'bedCount' => 123
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.nexspace365.com/api/facilities"
payload := strings.NewReader("{\n \"name\": \"<string>\",\n \"type\": \"<string>\",\n \"address\": \"<string>\",\n \"city\": \"<string>\",\n \"state\": \"<string>\",\n \"zip\": \"<string>\",\n \"phone\": \"<string>\",\n \"email\": \"jsmith@example.com\",\n \"website\": \"<string>\",\n \"licenseNumber\": \"<string>\",\n \"bedCount\": 123\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.nexspace365.com/api/facilities")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"<string>\",\n \"type\": \"<string>\",\n \"address\": \"<string>\",\n \"city\": \"<string>\",\n \"state\": \"<string>\",\n \"zip\": \"<string>\",\n \"phone\": \"<string>\",\n \"email\": \"jsmith@example.com\",\n \"website\": \"<string>\",\n \"licenseNumber\": \"<string>\",\n \"bedCount\": 123\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.nexspace365.com/api/facilities")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"<string>\",\n \"type\": \"<string>\",\n \"address\": \"<string>\",\n \"city\": \"<string>\",\n \"state\": \"<string>\",\n \"zip\": \"<string>\",\n \"phone\": \"<string>\",\n \"email\": \"jsmith@example.com\",\n \"website\": \"<string>\",\n \"licenseNumber\": \"<string>\",\n \"bedCount\": 123\n}"
response = http.request(request)
puts response.read_body{
"id": 1,
"name": "Downtown Distribution Center",
"type": "warehouse",
"address": "500 Industrial Pkwy",
"city": "Columbus",
"state": "OH",
"zip": "43004",
"phone": "+1-614-555-0142",
"email": "ops@acme.example.com",
"website": "https://acme.example.com",
"licenseNumber": null,
"bedCount": null,
"departments": [
"Receiving",
"Fulfillment",
"Shipping"
],
"isActive": true,
"createdAt": "2026-01-15T09:00:00Z",
"updatedAt": "2026-05-02T14:30:00Z"
}{
"error": {
"message": "<string>",
"code": "<string>",
"details": {},
"suggestion": "<string>",
"retryable": true
},
"requestId": "<string>"
}{
"error": {
"message": "<string>",
"code": "<string>",
"details": {},
"suggestion": "<string>",
"retryable": true
},
"requestId": "<string>"
}Authorizations
JWT token authentication
Headers
Pin the request to a dated API version (e.g. 2026-05-10). Applied by app-level middleware to every /api route (server/routes/index.ts → apiVersionMiddleware), which echoes the resolved value back in the NexSpace-Version response header. Omit to get the latest version. Discover the catalog at GET /.well-known/api-versions.
^\d{4}-\d{2}-\d{2}$Replay guard for write requests. Applied by app-level middleware to every /api route (server/routes/index.ts → idempotencyMiddleware), which only acts on POST/PUT/PATCH — GET, DELETE and OPTIONS ignore the header. Re-sending the same key with an identical body within 24 hours replays the original response; the same key with a different body returns 409.
255Body
Response
Facility created successfully
Unique facility identifier
Facility name
Facility/site type (industry-specific, free-form — e.g. clinic, branch, warehouse, store)
Facility address
City
State
ZIP code
Primary phone number
Primary email address
Facility website URL
Facility license number
Number of beds in the facility
List of departments in the facility
Whether the facility is active
Facility creation timestamp
Last update timestamp

