Contacts

The organization’s generic notification recipients - never assigned to websites. Catalog: app/Http/Queries/JsonApi/ContactQuery.php. Attributes: name (optional - a Contact can be unnamed), last_name, company, created_at, updated_at.

Public filters: id[] (exact contact ids), s (search over name/last_name/company), channel (email|whatsapp). Public sorts: name (default, ascending), last_name, company, created_at. Public includes: contact_methods.

Deletion is selection-only through bulk-destroy; there is no single-record destroy. A Contact keeps at most one method overall, email or WhatsApp, replaced under /contacts/{contact}/contact-methods (store replaces whichever method the Contact already has, update changes only value, channel is never accepted on update).

Writes are creator-scoped: a collaborator manages only the Contacts they created; an administrator or a global manager (a permission, not a role) manages every Contact of the organization. A Client id resolved on a Contact route, or a Contact id resolved on a Client route, answers 404 - the two share one underlying contacts table but are never interchangeable.