Google & Facebook

Auth-optional Google Business Profile and Facebook page connection endpoints for a store's review sites. Each accepts either a bearer token (authenticated admin/account flow) or an emailed-invite hash (no token) — with a hash, the target store_review_site must belong to the store the hash encodes. Google: exchange OAuth code for an access token, connect/disconnect a GBP location, and record browser-side connection-funnel tracking events. Facebook: save a validated user access token, connect/disconnect a page. Connect wipes obsolete scraped reviews, flips connection_status, and triggers a review pull; disconnect clears credentials and emails the account owner. All live in the public group.

Prerequisites

A bearer token in the Authorization header. Any endpoint that needs no token says so on its own page.
The id of each record the call targets. Every endpoint page lists the ids it needs.

Errors

Status	Meaning
`401`	The bearer token is missing, expired or invalid
`403`	The token is valid but the record sits outside your account
`422`	The request failed validation — the response names the fields
`500`	Unexpected server error

Individual endpoints may return more; each page lists its own.

Endpoints

Method	Endpoint	Description
`GET`	Google — exchange OAuth code for access token	Exchanges a Google OAuth `code` for an access token, stores it (`google_access_tokens`), and then branches: with `connect_google=1` + `company_id_hash` it links the token to that company and syncs its GBP locations (dispatching `DuplicateGMBDebugger`).
`POST`	Google — connect location to review site	Connect a Google Business Profile location to a store review site.
`GET`	Google — disconnect review site	Disconnect a Google Business Profile location from a store review site: clears the token/location, sets `sendto_scrapper=N`, `connection_status=disconnected`, `disconnect_reason=MANUAL`, clears the company `googleapi_access_token`, logs the change, emails the account owner (ACCOUNT_DISCONNECTED), and records a `DISCONNECTED_MANUAL` gbp event.
`POST`	Google — record connection tracking event	Record a browser-side step of the Google Business Profile connection funnel (sign-in clicked, consent denied, callback error, locations listed) for connection reporting.
`POST`	Facebook — save user access token	Validate a Facebook user access token via the Graph API debug endpoint and, if valid, persists the FB user details for the company.
`POST`	Facebook — connect page to review site	Connect a Facebook page to a store review site.
`GET`	Facebook — disconnect review site	Disconnect a Facebook page from a store review site: clears the token + URLs, sets `sendto_scrapper=N`, `connection_status=disconnected`, `disconnect_reason=MANUAL`, clears the company `fb_access_token`, logs the change, and emails the account owner (ACCOUNT_DISCONNECTED).