Rest API
API Routes
10/11/2026
Canonical Account API routes and service ownership for the Flutter client.
Service ownership
| Owner | Prefix/route | Notes |
|---|---|---|
| Laravel | /api/v1/auth/* | Auth, social login, verification, password, connected accounts |
| Laravel | /api/v1/auth/security/* | Session revoke and account deletion |
| Laravel | /api/v1/uploads | Authenticated uploads |
| Laravel | /api/v1/webhooks/revenuecat | RevenueCat webhook |
| Laravel | /api/v1/app/notifications/send | Super-admin send |
| Laravel | /api/v1/app/notifications/broadcast | Super-admin broadcast |
| Shared | /api/v1/app/* | Authenticated mobile resources; Laravel compatibility or Go performance mode |
Laravel auth/account routes
| Method | Endpoint | Purpose |
|---|---|---|
POST | /api/v1/auth/login | Email/password login |
POST | /api/v1/auth/register | Create account |
POST | /api/v1/auth/google | Google login |
POST | /api/v1/auth/apple | Apple login endpoint (backend contract) |
POST | /api/v1/auth/register/google | Google registration |
POST | /api/v1/auth/register/apple | Apple registration endpoint (backend contract) |
POST | /api/v1/auth/forgot-password, /reset-password | Password flows |
GET/POST | /api/v1/auth/email/* | Verify/resend verification |
POST/PUT | /api/v1/auth/logout, /update-password | Session/password lifecycle |
GET/POST/DELETE | /api/v1/auth/connected-accounts* | Connected providers |
DELETE | /api/v1/auth/security/sessions* | Session revocation |
DELETE | /api/v1/auth/security/delete-account | Account deletion |
POST | /api/v1/uploads | File upload |
POST | /api/v1/webhooks/revenuecat | RevenueCat event |
Shared mobile routes
These routes are implemented by Laravel compatibility mode and Go performance mode. Admin send/broadcast is intentionally not part of the Go shared contract.
| Method | Endpoint | Purpose |
|---|---|---|
GET | /api/v1/app/me | Current user |
POST | /api/v1/app/device-tokens | Store native/FCM token |
PUT | /api/v1/app/users/{uuid} | Update profile |
GET | /api/v1/app/security/authlogs | Login history |
GET | /api/v1/app/security/sessions | Active sessions |
GET | /api/v1/app/help-center | Help overview |
GET | /api/v1/app/help-center/faqs | Paginated/searchable FAQs |
GET | /api/v1/app/help-center/faqs/popular | Popular FAQs |
GET | /api/v1/app/help-center/faqs/{id} | FAQ detail |
GET | /api/v1/app/help-center/contacts | Contact methods |
GET | /api/v1/app/help-center/operating-hours | Operating hours |
GET | /api/v1/app/help-center/feedback | User feedback |
POST | /api/v1/app/help-center/feedback | Submit feedback (rate limited) |
GET | /api/v1/app/notifications | Notification history |
PUT | /api/v1/app/notifications/{id}/read | Mark one read |
PUT | /api/v1/app/notifications/read-all | Mark all read |
DELETE | /api/v1/app/notifications/{id} | Delete one |
DELETE | /api/v1/app/notifications | Delete all |
GET/PUT | /api/v1/app/notifications/preferences | Notification settings |
GET/PUT | /api/v1/app/preferences | User preferences |
GET | /api/v1/app/billing/entitlements | Active entitlements |
Health routes
The Go process also exposes GET /health (liveness) and GET /api/v1/health (readiness). These are service probes, not authenticated mobile resources. Unknown /api/v1/* paths and unsupported sync/admin aliases return 404.