REST API Overview

Contract

Account mobile requests use the /api/v1 prefix and a Laravel-style JSON envelope. services/api.ts constructs URLs from:

EXPO_PUBLIC_API_URL + /api/v1 + endpoint

Set the environment variable to the host root. Guest mode blocks the request layer entirely.

Ownership

• Laravel admin panel owns /api/v1/auth/*, /api/v1/auth/security/*, /api/v1/uploads, /api/v1/webhooks/revenuecat, and the admin notification send/broadcast routes.
• Shared mobile contract is under /api/v1/app/*. Laravel can serve it in compatibility mode; Go can serve the implemented protected resource routes in performance mode.
• Laravel remains canonical for migrations, auth issuance, destructive operations, uploads, webhooks, and admin-side delivery.

Authentication

Protected requests use a Laravel Sanctum personal access token:

Authorization: Bearer <token>
Accept: application/json
Content-Type: application/json

Token abilities are checked per route. A token issued by Laravel is the token the Go service validates; Go is not a separate identity provider.

Response envelope

Success responses generally look like:

{
  "success": true,
  "message": "Request completed successfully",
  "data": {}
}

Validation and other errors expose a message and, when applicable, an errors object. Common status codes are 401 (missing/invalid token), 403 (missing ability/role), 404 (unknown resource), 422 (validation), 429 (rate limit), and 503 (service/dependency unavailable).

See API Routes for the route-by-route list and Backend Architecture for gateway ownership.