Rest API
API Routes
10/11/2026
Canonical Account API routes and service ownership for the Expo client.
Service ownership
| Owner | Prefix/route | Notes |
|---|---|---|
| Laravel | /api/v1/auth/* | Auth, social login, verification, password, connected accounts |
| Laravel | /api/v1/auth/security/* | Session revoke and account deletion |
| Laravel | /api/v1/uploads | Authenticated file upload |
| Laravel | /api/v1/webhooks/revenuecat | RevenueCat webhook |
| Laravel | /api/v1/app/notifications/send | Super-admin send |
| Laravel | /api/v1/app/notifications/broadcast | Super-admin broadcast |
| Shared | /api/v1/app/* | Authenticated mobile resource contract; Laravel compatibility or Go performance mode |
Laravel auth and account routes
| Method | Endpoint | Purpose |
|---|---|---|
POST | /api/v1/auth/login | Email/password login |
POST | /api/v1/auth/register | Create an account |
POST | /api/v1/auth/google | Google login |
POST | /api/v1/auth/apple | Apple login |
POST | /api/v1/auth/register/google | Google registration |
POST | /api/v1/auth/register/apple | Apple registration |
POST | /api/v1/auth/forgot-password | Send reset link |
POST | /api/v1/auth/reset-password | Apply reset token |
GET | /api/v1/auth/email/verify/{id}/{hash} | Signed verification link |
POST | /api/v1/auth/email/verification-notification | Resend verification |
POST | /api/v1/auth/logout | Revoke current token |
PUT | /api/v1/auth/update-password | Change password |
GET | /api/v1/auth/connected-accounts | List providers |
POST | /api/v1/auth/connected-accounts/:provider | Link Google or Apple provider |
DELETE | /api/v1/auth/connected-accounts/{provider} | Unlink provider |
DELETE | /api/v1/auth/security/sessions/{id} | Revoke one session |
DELETE | /api/v1/auth/security/sessions | Revoke all sessions |
DELETE | /api/v1/auth/security/delete-account | Delete account |
POST | /api/v1/uploads | Upload profile/media file |
POST | /api/v1/webhooks/revenuecat | Process RevenueCat event |
Shared mobile routes
These routes are implemented by Laravel compatibility mode and the Go service. Admin-only operations are intentionally excluded from the Go shared contract.
| Method | Endpoint | Purpose |
|---|---|---|
GET | /api/v1/app/me | Current user profile |
POST | /api/v1/app/device-tokens | Store native device/FCM token |
PUT | /api/v1/app/users/{uuid} | Update current profile |
GET | /api/v1/app/security/authlogs | Login history |
GET | /api/v1/app/security/sessions | Active sessions |
GET | /api/v1/app/help-center | Help-center overview |
GET | /api/v1/app/help-center/faqs | Paginated/searchable FAQs |
GET | /api/v1/app/help-center/faqs/popular | Popular FAQs |
GET | /api/v1/app/help-center/faqs/{id} | FAQ detail |
GET | /api/v1/app/help-center/contacts | Contact methods |
GET | /api/v1/app/help-center/operating-hours | Operating hours |
GET | /api/v1/app/help-center/feedback | Current user's feedback |
POST | /api/v1/app/help-center/feedback | Submit feedback (rate limited) |
GET | /api/v1/app/notifications | Notification history |
PUT | /api/v1/app/notifications/{id}/read | Mark one read |
PUT | /api/v1/app/notifications/read-all | Mark all read |
DELETE | /api/v1/app/notifications/{id} | Delete one |
DELETE | /api/v1/app/notifications | Delete all |
GET | /api/v1/app/notifications/preferences | Notification preferences |
PUT | /api/v1/app/notifications/preferences | Update notification preferences |
GET | /api/v1/app/preferences | User preferences |
PUT | /api/v1/app/preferences | Update user preferences |
GET | /api/v1/app/billing/entitlements | Active entitlements |
Health routes
The Go process also exposes:
GET /health— liveness (root path).GET /api/v1/health— readiness and database status.
These are service probes, not Account-authenticated mobile routes. Unknown /api/v1/* paths and intentionally unsupported sync/admin aliases return 404.