Settings

The settings module provides endpoints for user / organization preference configuration. Currently most service methods are still stubs (placeholder strings) — the CreateSettingDto and UpdateSettingDto DTOs are empty. These endpoints live at the /settings route and all require Bearer JWT (no specific ACL permissions).

Property	Value
Base URL	{HOST}/v1
Auth	Bearer JWT (header Authorization) or access_token cookie
Content-Type	application/json
Error envelope	{ "message": string | string[], "statusCode": number, "error": string }
Validation	Global ValidationPipe · whitelist: true, forbidNonWhitelisted: true
Related modules	users, organizations
Document version	v1 · 2026-05-20
Audience	Internal FE devs (mobile + web)

Summary

Five standard REST endpoints, still at an early stage. The service only fills in createSettings (creating a basic UsersSettings record with user_id from the token) — the rest (findAll, findOne, update, remove) still return string stubs. FE should not hard-code the response schema; wait for the next backend release.

Method	Path	Auth	Summary
POST	/v1/settings	bearer	Create user settings (uses user from token)
GET	/v1/settings	bearer	List all settings (stub)
GET	/v1/settings/:settings_id	bearer	Detail of one setting by ID (stub)
PATCH	/v1/settings/:settings_id	bearer	Update a setting (stub)
DELETE	/v1/settings/:settings_id	bearer	Delete a setting (stub)

Implementation notes

• CreateSettingDto and UpdateSettingDto are empty — the body FE sends must be {} to avoid being rejected by forbidNonWhitelisted.
• The UsersSettings entity currently only stores user_id + audit fields. OrganizationSettings stores organization_id. Configuration fields are not yet exposed in the public API.
• No @Permissions on the controller — only the global Bearer guard applies.
• The settings_id parameter is cast to number (+id) by the stub service; there is no UUID validation yet.

---

POST /v1/settings bearer

Create a new UsersSettings record for the logged-in user. The DTO body is empty; the server fills in user_id and created_by from the token.

bearer

Request body — CreateSettingDto

Field	Type	Required	Notes
(empty)	—	—	The DTO does not define any field yet. Send body {}.

Example request

{}

Response — 201 Created

{
  "status": "success",
  "statusCode": 201,
  "message": "Success",
  "data": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "user_id": "660e8400-e29b-41d4-a716-446655440111",
    "created_by": "660e8400-e29b-41d4-a716-446655440111",
    "created_at": "2026-05-20T08:30:00.000Z",
    "updated_at": "2026-05-20T08:30:00.000Z"
  }
}

Errors

Status	When it occurs
400 Bad Request	Body contains non-whitelisted field
401 Unauthorized	Bearer/cookie is invalid

---

GET /v1/settings bearer

List all settings. The service is still a stub — returns a placeholder string.

bearer

Response — 200 OK

{
  "status": "success",
  "statusCode": 200,
  "message": "Success",
  "data": "This action returns all settings"
}

Errors

Status	When it occurs
401 Unauthorized	Bearer/cookie is invalid

---

GET /v1/settings/:settings_id bearer

Detail of one setting. The service is a stub — no real lookup yet.

bearer

Path params

Param	Type	Notes
settings_id	string	Currently cast to number (+id); no ParseUUIDPipe yet

Response — 200 OK

{
  "status": "success",
  "statusCode": 200,
  "message": "Success",
  "data": "This action returns a #1 setting"
}

Errors

Status	When it occurs
401 Unauthorized	Bearer/cookie is invalid

---

PATCH /v1/settings/:settings_id bearer

Update a setting. The DTO is still PartialType(CreateSettingDto) empty — body must be {}.

bearer

Path params

Param	Type	Notes
settings_id	string	See notes on the detail endpoint

Request body — UpdateSettingDto

Field	Type	Required	Notes
(empty)	—	—	The DTO has no fields; service is a stub

Response — 200 OK

{
  "status": "success",
  "statusCode": 200,
  "message": "Success",
  "data": "This action updates a #1 setting"
}

Errors

Status	When it occurs
400 Bad Request	Non-whitelisted field in body
401 Unauthorized	Bearer/cookie is invalid

---

DELETE /v1/settings/:settings_id bearer

Delete a setting. Service stub.

bearer

Path params

Param	Type	Notes
settings_id	string	See notes on the detail endpoint

Response — 200 OK

{
  "status": "success",
  "statusCode": 200,
  "message": "Success",
  "data": "This action removes a #1 setting"
}

Errors

Status	When it occurs
401 Unauthorized	Bearer/cookie is invalid

---

Reference

Existing entities

• UsersSettings — user_id + audit fields
• OrganizationSettings — organization_id + audit fields

Configuration schemas (notifications, language, etc.) are not yet exposed in the public API.

Auth

• Bearer JWT required on all endpoints
• No specific @Permissions or @Roles

Standard error envelope

{
  "message": "property unknown_field should not exist",
  "statusCode": 400,
  "error": "Bad Request"
}

Common HTTP codes

• 400 body contains unknown field
• 401 missing / expired token
• 500 the service stub may throw a raw error when called