REST API

CartUser exposes 72+ REST endpoints under /api. Same API powers the user app, seller app, delivery app, and your custom integrations. Auth via Laravel Sanctum bearer tokens.

Base URL

https://yourdomain.com/api

Authentication

Public endpoints

These work without token:

• GET /api/config — site settings, languages, currencies
• GET /api/products — product list
• GET /api/product/{uid} — product detail
• GET /api/category/products/{uid} — products by category
• GET /api/brand/products/{uid} — products by brand
• POST /api/login — get token
• POST /api/register — create account + get token

Protected endpoints (token required)

Include in header:

Authorization: Bearer {token}
Accept: application/json

Getting a token

POST /api/login
Content-Type: application/json

{
    "username": "[email protected]",
    "password": "123123"
}

Response:

{
    "success": true,
    "data": {
        "access_token": "1|aBcD1234...",
        "user": { ... }
    }
}

Endpoint groups

Auth

• POST /api/register — register customer
• POST /api/login — login, returns token
• POST /api/logout — invalidate token
• POST /api/password/forget — send password reset OTP
• POST /api/password/reset — reset with OTP
• POST /api/otp/verify — verify email/phone OTP
• POST /api/otp/resend — resend OTP

Config

• GET /api/config — settings, countries, currencies, languages, payment methods, frontend sections, onboarding pages
• GET /api/translate/{key} — translate string to current locale

Products

• GET /api/products — list with filters (category, brand, price range, sort)
• GET /api/product/{uid}/{camp_uid?} — product detail
• GET /api/category/products/{uid} — by category
• GET /api/brand/products/{uid} — by brand
• GET /api/campaigns/{uid} — campaign products
• POST /api/product/review — submit review (requires token)

Cart

• GET /api/cart — current cart items
• POST /api/cart/add — add product
• POST /api/cart/update — change quantity
• POST /api/cart/remove — remove item
• POST /api/cart/clear — empty cart

Wishlist

• GET /api/wishlist
• POST /api/wishlist/add
• POST /api/wishlist/remove

Checkout

• POST /api/checkout — place order
  • Required: address_id, payment_id, delivery_option
  • Optional: coupon_code, wallet_payment, order_notes
• POST /api/digital/checkout — digital product checkout
• POST /api/checkout/complete — finalize after gateway redirect
• GET /api/payment/log/{trx_code} — verify payment status

Orders

• GET /api/orders — customer's order list
• GET /api/order/{uid} — order detail
• POST /api/order/cancel — cancel order
• POST /api/order/return — request return

Profile

• GET /api/profile
• POST /api/profile/update
• POST /api/profile/password
• POST /api/profile/image
• POST /api/profile/fcm-token — register for push notifications

Addresses

• GET /api/addresses
• POST /api/address/store
• POST /api/address/update
• POST /api/address/delete

Wallet & transactions

• GET /api/wallet
• POST /api/wallet/recharge
• GET /api/transactions

Reward points

• GET /api/reward/log — earned points history
• POST /api/reward/redeem — redeem to wallet

Chat

• GET /api/chat/conversations
• POST /api/chat/send
• GET /api/chat/messages/{conversation_id}

Support tickets

• GET /api/tickets
• POST /api/ticket/create
• POST /api/ticket/reply

Shop / sellers

• GET /api/shop — seller list
• GET /api/shop/visit/{id} — increment visit counter

Error responses

// Validation error (422)
{
    "success": false,
    "data": {
        "errors": ["Email field is required"]
    },
    "message": "Validation failed"
}

// Auth error (401)
{
    "success": false,
    "message": "Unauthenticated"
}

// Not found (404)
{
    "success": false,
    "message": "Resource not found"
}

// Server error (500)
{
    "success": false,
    "message": "Server error message"
}

Standard success format

{
    "success": true,
    "data": {
        "products": [ ... ],
        "pagination": {
            "current_page": 1,
            "total": 50
        }
    },
    "message": "Success"
}

Pagination

List endpoints use ?page=N query param. Page size set in admin (default 10). Response includes pagination meta.

Rate limits

Default: 60 requests/minute per IP. Adjust in kode/app/Providers/RouteServiceProvider.php.

CORS

CORS is enabled for all origins by default. Restrict in kode/config/cors.php:

'allowed_origins' => ['https://yourapp.com'],

Testing with curl

# Login
curl -X POST https://yourdomain.com/api/login \
  -H "Content-Type: application/json" \
  -d '{"username":"[email protected]","password":"123123"}'

# Use token
curl https://yourdomain.com/api/profile \
  -H "Authorization: Bearer 1|aBcD1234..." \
  -H "Accept: application/json"

Postman collection

Generate a Postman collection from your installation:

cd /home/user/public_html/kode
php artisan export:postman

Output: storage/app/cartuser.postman_collection.json. Import into Postman.