diff --git a/src/app/api/areas/route.ts b/src/app/api/areas/route.ts
new file mode 100644
index 0000000..0ed2fd2
--- /dev/null
+++ b/src/app/api/areas/route.ts
@@ -0,0 +1,44 @@
+import { NextResponse } from "next/server";
+import { auth } from "@/auth";
+import { createOrGetArea, listAreas, validateCreateAreaInput } from "@/lib/areas";
+
+// Session-authed Area list/create for the review page — mirrors
+// src/app/api/employees/route.ts's pattern. The bot uses the separate
+// bot-secret-authed /api/bot/areas instead (see src/lib/bot-auth.ts).
+export async function GET(): Promise<NextResponse> {
+  const session = await auth();
+  if (!session) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  const areas = await listAreas();
+  return NextResponse.json(areas, { status: 200 });
+}
+
+export async function POST(request: Request): Promise<NextResponse> {
+  const session = await auth();
+  if (!session) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  let body: unknown;
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json({ error: "Request body must be valid JSON" }, { status: 400 });
+  }
+  if (typeof body !== "object" || body === null) {
+    return NextResponse.json({ error: "Request body must be a JSON object" }, { status: 400 });
+  }
+
+  const { name, team } = body as Record<string, unknown>;
+  const validation = validateCreateAreaInput({ name, team });
+  if (!validation.ok) {
+    return NextResponse.json({ error: validation.error }, { status: 400 });
+  }
+
+  const created = await createOrGetArea(validation.value);
+  if (!created.ok) {
+    return NextResponse.json({ error: created.error }, { status: 400 });
+  }
+  return NextResponse.json(created.value, { status: 201 });
+}
diff --git a/src/app/api/inventory-scans/[id]/photo/route.ts b/src/app/api/inventory-scans/[id]/photo/route.ts
new file mode 100644
index 0000000..0a67dd5
--- /dev/null
+++ b/src/app/api/inventory-scans/[id]/photo/route.ts
@@ -0,0 +1,63 @@
+import { NextResponse } from "next/server";
+import { auth } from "@/auth";
+import { getInventoryScan } from "@/lib/inventory-scans";
+
+// Streams the scan's photo on demand straight from Telegram's file storage
+// — see prisma/schema.prisma's InventoryScan.photoFileId comment for why
+// this app doesn't keep its own copy on disk. Telegram's getFile file_path
+// is short-lived, so this re-resolves it on every request rather than
+// caching a URL.
+export async function GET(
+  request: Request,
+  { params }: { params: { id: string } }
+): Promise<NextResponse> {
+  const session = await auth();
+  if (!session) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const scan = await getInventoryScan(params.id);
+  if (!scan || !scan.photo_file_id) {
+    return NextResponse.json({ error: "No photo for this scan" }, { status: 404 });
+  }
+
+  const botToken = process.env.BOT_TOKEN;
+  if (!botToken) {
+    return NextResponse.json({ error: "BOT_TOKEN not configured" }, { status: 500 });
+  }
+
+  const fileResp = await fetch(
+    `https://api.telegram.org/bot${botToken}/getFile?file_id=${encodeURIComponent(scan.photo_file_id)}`
+  );
+  const fileJson = await fileResp.json();
+  if (!fileJson.ok) {
+    return NextResponse.json({ error: "Telegram getFile failed" }, { status: 502 });
+  }
+
+  const filePath = fileJson.result.file_path as string;
+  const imageResp = await fetch(`https://api.telegram.org/file/bot${botToken}/${filePath}`);
+  if (!imageResp.ok || !imageResp.body) {
+    return NextResponse.json({ error: "Failed to fetch photo from Telegram" }, { status: 502 });
+  }
+
+  // Telegram serves file content as generic application/octet-stream
+  // regardless of the actual file type, which makes browsers download
+  // instead of display it inline — derive the real content type from the
+  // file_path extension instead of trusting imageResp's header.
+  const extension = filePath.split(".").pop()?.toLowerCase();
+  const contentType =
+    extension === "png"
+      ? "image/png"
+      : extension === "webp"
+        ? "image/webp"
+        : "image/jpeg";
+
+  return new NextResponse(imageResp.body, {
+    status: 200,
+    headers: {
+      "Content-Type": contentType,
+      "Content-Disposition": "inline",
+      "Cache-Control": "private, max-age=3600",
+    },
+  });
+}
diff --git a/src/app/api/inventory-scans/[id]/route.ts b/src/app/api/inventory-scans/[id]/route.ts
new file mode 100644
index 0000000..d9c9223
--- /dev/null
+++ b/src/app/api/inventory-scans/[id]/route.ts
@@ -0,0 +1,76 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { auth } from "@/auth";
+import {
+  deleteInventoryScan,
+  updateInventoryScan,
+  validateUpdateInventoryScanInput,
+} from "@/lib/inventory-scans";
+
+// Review-page edit/delete — session-authed, mirrors
+// src/app/api/assignments/[id]/route.ts's pattern (synchronous params,
+// explicit UUID pre-check before hitting Prisma).
+export async function PATCH(
+  request: Request,
+  { params }: { params: { id: string } }
+): Promise<NextResponse> {
+  const session = await auth();
+  if (!session) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  if (!z.string().uuid().safeParse(params.id).success) {
+    return NextResponse.json({ error: "id must be a valid UUID string" }, { status: 400 });
+  }
+
+  let body: unknown;
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json({ error: "Request body must be valid JSON" }, { status: 400 });
+  }
+  if (typeof body !== "object" || body === null) {
+    return NextResponse.json({ error: "Request body must be a JSON object" }, { status: 400 });
+  }
+
+  const { modelId, areaId, assignedEmployeeId, assetTag, serialNumber, specs } =
+    body as Record<string, unknown>;
+  const validation = validateUpdateInventoryScanInput({
+    modelId,
+    areaId,
+    assignedEmployeeId,
+    assetTag,
+    serialNumber,
+    specs,
+  });
+  if (!validation.ok) {
+    return NextResponse.json({ error: validation.error }, { status: 400 });
+  }
+
+  const updated = await updateInventoryScan(params.id, validation.value);
+  if (!updated.ok) {
+    const status = updated.error === "InventoryScan not found" ? 404 : 400;
+    return NextResponse.json({ error: updated.error }, { status });
+  }
+  return NextResponse.json(updated.value, { status: 200 });
+}
+
+export async function DELETE(
+  request: Request,
+  { params }: { params: { id: string } }
+): Promise<NextResponse> {
+  const session = await auth();
+  if (!session) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  if (!z.string().uuid().safeParse(params.id).success) {
+    return NextResponse.json({ error: "id must be a valid UUID string" }, { status: 400 });
+  }
+
+  const result = await deleteInventoryScan(params.id);
+  if (!result.ok) {
+    return NextResponse.json({ error: result.error }, { status: 404 });
+  }
+  return new NextResponse(null, { status: 204 });
+}
diff --git a/src/app/api/inventory-scans/route.ts b/src/app/api/inventory-scans/route.ts
new file mode 100644
index 0000000..cc3291c
--- /dev/null
+++ b/src/app/api/inventory-scans/route.ts
@@ -0,0 +1,16 @@
+import { NextResponse } from "next/server";
+import { auth } from "@/auth";
+import { listInventoryScans } from "@/lib/inventory-scans";
+
+// Review-page read — session-authed like every other human-facing route
+// (src/app/api/assets/route.ts's GET is the mirrored pattern). Create is
+// bot-only (POST /api/bot/inventory-scans); edit/delete are
+// /api/inventory-scans/[id].
+export async function GET(): Promise<NextResponse> {
+  const session = await auth();
+  if (!session) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  const scans = await listInventoryScans();
+  return NextResponse.json(scans, { status: 200 });
+}