loyaly-merchant/docs/PLATFORM-STATUS.md

Live platform status — mcp.loyaly.ai

Probed 2026-09-09. LOYALY_API_BASE=https://mcp.loyaly.ai

The host is confirmed as the Behavision platform: it answers the documented flat {"error": "...", "message": "..."} contract with the documented codes (bad_credentials, unauthorized, not_found, bad_request).

8 of the 16 endpoints the spec documents are not deployed yet. A 401 unauthorized proves the route exists and is gated. A 404 {"error":"not_found","message":"No such endpoint."} means it is absent.

Live

Endpoint	Probe	Console feature
POST /api/auth/login	401 bad_credentials	Sign in — wired
POST /api/auth/refresh	400 refresh_token is required	Token rotation — wired
POST /api/auth/logout	401 unauthorized	Sign out — wired
GET /api/auth/me	401 unauthorized	Session confirmation — wired
GET /api/sites	401 unauthorized	Site switcher + Store page — wired
GET /api/visitors	401 unauthorized	Customer directory — service written, UI not built
GET /api/reports/footfall	401 unauthorized	Visitors KPI + Footfall chart — wired
GET /api/reports/conversion	401 unauthorized	Purchases/Revenue/Conversion + Sales — wired

Not deployed

Endpoint	Probe	Blocks
GET /api/visits	404	Recent arrivals feed, Activity page
POST /api/purchases	404	Mobile → dashboard purchase flow
GET /api/team	404	Leaderboard team table
GET /api/team/invitations	404	Invite flow
GET /api/auth/invitation	404	Join preview
POST /api/auth/register	404	Redeeming an invitation
GET /api/auth/sessions	404	Device management
GET /api/cameras	404	Camera list / live view

Consequence for the "most important requirement"

The brief's §7 flow —

Mobile → POST /api/visits → DB → Dashboard GET /api/visits → new visit appears
Mobile → POST /api/purchases → DB → reports update

— cannot run today. Neither /api/visits nor /api/purchases is deployed. The console side is built and pointed at both; they return 404 until the platform ships them.

What does work end to end once there is an account: sign in, site switching, and every KPI and chart on the Dashboard and Sales pages, since those read the two report endpoints that are live.

Still needed

A valid account on mcp.loyaly.ai. There is no open registration by design, and POST /api/auth/register is not deployed either — so an account has to be created directly on the platform side.