REST API Overview

Contract

DioService builds Account URLs from:

Endpoints.baseURL + /api/v1 + routePath

Set the host root via API_BASE_URL — the apiBaseUrl default in lib/config/app_env.dart or a --dart-define. Guest mode blocks all network methods.

Ownership

• Laravel admin panel owns /api/v1/auth/*, /api/v1/auth/security/*, /api/v1/uploads, /api/v1/webhooks/revenuecat, and admin notification send/broadcast.
• Shared mobile contract is under /api/v1/app/*; Laravel serves compatibility mode and Go serves the implemented performance-mode resources.
• Laravel remains canonical for migrations, token issuance, destructive operations, uploads, webhooks, and admin delivery.

Authentication

Protected calls use a Laravel Sanctum personal access token:

Authorization: Bearer <token>
Accept: application/json
Content-Type: application/json

Abilities are checked per route. The Go service validates Laravel's token records; it is not a second identity provider.

Response/error handling

Successful responses use the Laravel-style success, message, and data envelope parsed into ApiResult models. Common statuses are 401 (invalid token), 403 (ability/role), 404 (missing route/resource), 422 (validation), 429 (rate limit), and 503 (dependency unavailable).

See API Routes and Backend Architecture.