POST /api/visitor Authorization: Bearer <token> Content-Type: application/json