Switch checklist

What the app must change, route by route, when it moves a call from Shukah to Locate. Each item is a breaking difference found by the parity audit of 2026-10-02: paired calls on dev, or code reading where a live call was unsafe; each route's TL;DR says which. Routes not listed under breaking changes are drop-in: only the base URL and path change (see each TL;DR's to-watch lines: a method or token can still differ). Items shared by several routes are listed once at the top, with the routes they apply to.

Before anything else: keep both tokens. Keep logging in on Shukah. Get the Locate JWT with exchange-token (target_platform: locate) and store both tokens. Send the JWT to the auth service's client routes, and the Shukah token to order-v2 and to the routes left on Shukah. Do not move verify-otp (login) to Locate until order-v2 accepts the JWT: Locate login returns only a JWT, which the order-v2 points routes refuse today (why).

Click a route for its endpoint page, which has the full TL;DR and the field tables.

Applies to several routes

• ☐ Shukah token gets 401 "Unauthorization"; send a Locate JWT (from exchange-token; keep the Shukah token)
  • GET /maeda/api/verify-token → GET /api/v1/clients/verify-token
  • GET /maeda/client → GET /api/v1/clients
  • GET /maeda/address-book → GET /api/v1/clients/address-book
  • GET /maeda/address-book/:id → GET /api/v1/clients/address-book/:id
  • POST /maeda/address-book → POST /api/v1/clients/address-book
  • PUT /maeda/address-book/:id → PUT /api/v1/clients/address-book/:id
  • DELETE /maeda/address-book/:id → DELETE /api/v1/clients/address-book/:id
  • PUT /maeda/client/:client_id → PUT /api/v1/clients/:client_id
  • PUT /maeda/client/:client_id → PUT /api/v1/clients/setting

Breaking changes to handle

• GET /maeda/api/verify-otp → GET /api/v1/clients/verify-otp
  • ☐ Do not switch login yet: Locate login returns only a JWT, which order-v2 point routes refuse today
• GET /maeda/api/verify-token → GET /api/v1/clients/verify-token
  • ☐ On this 401 the app deletes its stored token (auth.service.ts:101), so exchange the token first
• GET /maeda/address-book → GET /api/v1/clients/address-book
  • ☐ Locate-made addresses have null formatted_address/street/city; the app sends formatted_address as c_address
• POST /maeda/address-book → POST /api/v1/clients/address-book
  • ☐ Answer is {status,address:{...}}; the app builds the preset from the top level, so id and lat/lng are NaN
  • ☐ No geocoding: street, city, area, state, zipcode, country, formatted_address are null (Shukah fills them)
• DELETE /maeda/address-book/:id → DELETE /api/v1/clients/address-book/:id
  • ☐ The app sends +id, so a 24-hex id becomes NaN and delete answers 404; the slice compares +id too
• PUT /maeda/client/:client_id → PUT /api/v1/clients/setting
  • ☐ The app flips push through PUT client/:id; Locate ignores push_enabled there, so call PUT /clients/setting
• GET /maeda/client/point-history → GET /api/v2/client/point-history
  • ☐ Locate pages at 20 rows (max 100); Shukah sent all 8,136; the app sends no paging, so it stops at 20
  • ☐ No total or next-page marker; loop with page and limit (default 20, max 100) until a short page
• POST /maeda/point-order → POST /api/v2/client/point-orders
  • ☐ No point_order_id: the app builds pointOrderId = String(undefined) = "undefined"; amount is named money_amount
  • ☐ Also missing: client_id, to_client_id, point_occasion_id, occasion, description, payment_point_order_id
  • ☐ Pay routes need the UUID correlation_id in the path; keep it from create or pay answers 404
  • ☐ A spend was not taken off the other side within seconds (later not checked): read balance and history where you order
  • ☐ payment_type payfort or hyperpay (the app sends the settings value) is 400; only point or checkout work
  • ☐ point_offer_id and point_occasion_id must be the 24-hex ids from the Locate lists; Shukah integers are 400
• POST /maeda/order/checkout-payment-standalone → POST /api/v2/client/point-orders/:correlation_id/pay/card
  • ☐ Order id moves from body point_order_id (string "1252") to the path as the UUID correlation_id
  • ☐ The app keeps only pointOrderId; from a Locate create it is "undefined", so the call is 404 "point order not found"
• POST /maeda/order/checkout-payment-flow → POST /api/v2/client/point-orders/:correlation_id/pay/session
  • ☐ Order id moves from body point_order_id (string "1253") to the path as the UUID correlation_id
  • ☐ The app keeps only pointOrderId; from a Locate create it is "undefined", so the call is 404

Not replaced: keep calling Shukah

• GET /maeda/client/status — No Locate route. The app snapshot declares this route but no code calls it, yet the production traffic sheet of 2026-10-02 shows 768 calls in 3 days; dev Shukah answers 404 "The route maeda/client/status could not be found."
• GET /maeda/client/delete — No Locate route deletes an account, so the app keeps calling this Shukah route, which needs a token Shukah accepts. The app deletes its stored token on a 401 here, so a JWT-only app is signed out by it.
• GET /maeda/point-order — No Locate route lists the sent gifts of a user, so the Sent gifts tab keeps calling Shukah.
• POST /maeda/order/checkout-payment — For point orders, Locate offers only a saved-card route and a session route, so the route that pays with a Checkout.com card token has no replacement. 0 calls in the production traffic sheet of 2026-10-02 (3 days).
• POST /maeda/order/checkout-payment-stcpay — By design (D24), Locate is meant to handle STC Pay inside the pay-session route, not the separate order-v2 STC Pay endpoint; not yet proven on a device.
• POST /maeda/order/payfort-token — PayFort is deferred by design for Locate point orders, so the PayFort path keeps calling Shukah. 0 calls in the production traffic sheet of 2026-10-02 (3 days).
• POST /maeda/order/payfort-stc-pay-checkout — PayFort is deferred by design for Locate point orders, so this STC Pay path keeps calling Shukah. 0 calls in the production traffic sheet of 2026-10-02 (3 days).

How this list is made

The list is rendered from the migration registry (registry.ts): every breaking difference, then every route with the blocked verdict, then every route with no Locate replacement. To change an item, change the registry entry; see Migration progress.