API endpoints

The API serves 297 endpoints under 41 /api base paths, plus the health checks. Every router is mounted in 📄apps/api/src/app.ts. The handlers live in apps/api/src/modules/*/*.routes.ts and, for older domains, in apps/api/routes/*.ts. How the server is built is explained in API server.

Access legend

Code	Meaning
P	Public: no sign-in needed
U	Signed in: any valid Authorization: Bearer token (protect)
A	Admin: signed in and role admin (protect + requireAdmin)
OA	Optional auth: works signed out; uses the user if a token is sent
role	A named guard, such as vendor or packer — see Auth and roles

:id stands for a MongoDB ObjectId. While the API runs outside production, Swagger UI is served at /api/docs.

Health and system

Method	Path	Access	Purpose
GET	/	P	API welcome message
GET	/health, /health/live	P	Liveness
GET	/health/ready	P	Readiness (checks the MongoDB connection)
POST	/api/payments/webhook	P	Stripe webhook, raw body, signature-checked

Accounts

Auth — /api/auth

Method	Path	Access	Purpose
POST	/login, /register	P	Email sign-in and sign-up
POST	/oauth	P	Google / GitHub / Firebase ID-token sign-in
POST	/forgot-password, /reset-password	P	Password reset by email
GET	/profile	U	Current user
POST	/logout	U	Stateless; the client drops the token
POST	/set-password	U	Add a password to an OAuth account

The six public routes share a stricter limit: 10 requests per minute.

Users — /api/users

Method	Path	Access	Purpose
GET	/dashboard-stats	A	User statistics
GET, POST	/	A	List or create users
GET, PUT	/:id	U	Read or update a user
DELETE	/:id	A	Delete a user
POST	/:id/addresses	U	Add an address
PUT, DELETE	/:id/addresses/:addressId	U	Edit or remove an address
PUT	/:id/password	U	Change password
GET	/:id/password	A	Retired; always returns 410

Roles — /api/users/roles

Method	Path	Access	Purpose
GET, POST	/employees	admin or incharge	List or create employees
GET	/employees/by-role/:employee_role	admin or incharge	Employees with one sub-role
PUT	/employees/:id/role	admin or incharge	Change an employee’s sub-role
PUT	/employees/:id/deactivate	A	Deactivate an employee
GET	/with-roles	A	Users with their roles
PUT	/:id/main-role	role managers	Change a user’s main role

Other account routes: /api/addresses (GET / A, GET /user/:id U) and /api/user-analytics (U: overview, monthly-spending, order-history, product-preferences).

Catalog

Products — /api/products

Method	Path	Access	Purpose
GET	/, /:id	OA	List (filters, pagination) and detail
POST	/	admin or vendor	Create a product
POST	/search-by-image	P	Image search (10 per minute)
POST	/bulk	A	Bulk import
PUT, DELETE	/:id	A	Edit or delete
PUT	/:id/approve, /:id/approval	A	Approve a vendor product (same handler)
GET	/pending/all, /dashboard-stats, /vendor	A	Admin views
GET	/vendor/me	vendor	The vendor’s own products
POST	/:id/rate, /:id/review	U	Rate or review
POST	/:id/view	P	Count a view
GET	/reviews/pending, /reviews/approved	A	Review moderation lists
PUT	/:productId/review/:reviewId	A	Approve or update a review

Catalog lookups

These routers share one CRUD shape: GET / and GET /:id are P, while POST /, PUT /:id and DELETE /:id are A.

Base path	Extra routes
/api/categories	GET /tree, GET /:id/subcategories (P); GET /admin, POST /bulk (A); GET /:id is U
/api/brands	GET /admin (A)
/api/product-types	GET /admin (A)
/api/product-bases	GET /active, GET /slug/:slug (P)
/api/colors, /api/sizes	—

Shopping

Cart and wishlist

Method	Path	Access	Purpose
GET, POST, DELETE	/api/cart	U	Read, add to, or clear the cart
PUT	/api/cart/update	U	Change a quantity
DELETE	/api/cart/:productId	U	Remove one product
GET	/api/wishlist	U	Read the wishlist
POST	/api/wishlist/add, /api/wishlist/products	U	Add, or fetch wishlist products
DELETE	/api/wishlist/remove, /api/wishlist/clear	U	Remove one or all

Orders — /api/orders

Method	Path	Access	Purpose
POST	/	U	Create an order from the cart
POST	/cod	U	Create a cash-on-delivery order
GET	/, /:id	U	My orders, one order
PUT, DELETE	/:id	U	Edit or delete an order (the controller checks who may)
PUT	/:id/status	U	Change status
PUT	/:id/webhook-status	OA	Confirm a Stripe payment by session id (20 per minute)
GET	/admin	employee	All orders for staff
GET	/search-products	U	Product search while editing an order

The lifecycle behind these is on How it works.

Order workflow — /api/orders/workflow

All routes require sign-in plus the employee sub-role shown.

Method	Path	Role	Purpose
GET	/call-center/queue	call_center	Orders to confirm
PUT	/:id/confirm-address, /:id/confirm-order	call_center	Confirm address, then order
GET	/packer/queue	packer	Orders to pack
PUT	/:id/pack	packer	Mark packed
GET	/delivery/queue	incharge	Orders to dispatch
PUT	/:id/assign-packer, /:id/assign-deliveryman	incharge	Assign staff
GET	/my-deliveries	deliveryman	My deliveries
PUT	/:id/start-delivery, /:id/deliver, /:id/return-cod	deliveryman	Delivery steps
PUT	/:id/collect-cod	can collect cash	Record cash collected
GET	/accounts/cod-pending, /accounts/completion-queue	accounts	Accounts queues
PUT	/:id/complete	accounts	Complete the order
GET	/workflow/stats	employee	Workflow counts

Caution

Because the router is mounted at /api/orders/workflow, the stats route’s full path is /api/orders/workflow/workflow/stats.

Payments — /api/payments

Method	Path	Access	Purpose
POST	/create-intent	U	Stripe PaymentIntent for an order (mobile)
POST	/sslcommerz/init	U	Start an SSLCommerz payment
POST	/sslcommerz/success, /fail, /cancel, /ipn	P	SSLCommerz callbacks

See Payments.

Staff operations

Base path	Access	Routes
/api/cash-collections	U + role	POST /backfill (A); deliveryman: GET /my-collections, GET /accounts-employees, PUT /submit; accounts: GET /accounts/pending, GET /accounts/received, PUT /accounts/confirm, GET /accounts/stats
/api/salaries	A	GET /, GET /stats, GET /employees, POST /seed-demo, GET /:id, POST /, PUT /:id, PATCH /:id/pay, DELETE /:id
/api/purchases	A	GET /, POST /, GET /stats, GET /:id, PUT /:id, DELETE /:id, PUT /:id/status
/api/suppliers	A	CRUD (5 routes)
/api/stats	employee	GET / dashboard stats
/api/analytics	admin or accounts	GET /overview, /products, /sales, /inventory-alerts
/api/search	A	GET / global admin search

Vendors — /api/vendors

Method	Path	Access	Purpose
GET	/approved, /config	P	Approved vendors; whether vendors are enabled
POST	/	U	Apply to become a vendor
GET	/me, /dashboard/stats	U	My vendor status and stats
GET, POST	/products	U	My vendor products
PUT, DELETE	/products/:id	U	Edit or delete my product
GET	/, /requests	A	All vendors (same handler)
POST	/create	A	Create a vendor
PUT	/config, /:id/status, /:id	A	Global config, approve/reject, edit

Content and site

Base path	Access	Routes
/api/banners	P / A	CRUD + GET /admin (A); GET /:id is U
/api/ads-banners, /api/component-types	P / A	CRUD + PATCH /:id/toggle (A)
/api/social-media	P / A	CRUD + GET /admin (A); GET /:id is A
/api/website-icons	P / A	GET /, /key/:key, /category/:category (P); POST, PUT /:id with image upload, DELETE /:id (A)
/api/website-config	A	CRUD, GET /page/:pageType, PUT /reorder, PATCH /:id/toggle
/api/menus	P / A	GET /public (P); CRUD, PUT /reorder, PATCH /:id/toggle (A)
/api/pages	P	GET /nav/menu, /all-slugs, /, /:slug
/api/admin/pages	A	Page CRUD, plus POST /:pageId/sections, PATCH /:pageId/sections/reorder, PATCH/DELETE /sections/:id
/api/blogs	P / A	GET /, GET /slug/:slug (P); GET /all, GET /admin/:id, POST, PUT /:id, DELETE /:id (A)
/api/blog-authors, /api/blog-categories, /api/blog-tags	P / A	GET / (P); GET /all, GET /:id, POST, PUT /:id, DELETE /:id (A)

Messaging and files

Base path	Access	Routes
/api/notifications	U	GET /, GET /unread-count, PUT /read-all, PUT /:id/read, DELETE /:id, DELETE /, POST /test; admin: POST /admin/bulk-send, GET /admin/bulk-sends, GET /admin/users, GET /admin/stats
/api/subscriptions	P / A	POST /subscribe, POST /unsubscribe (P); GET /, GET /stats, DELETE /:id (A)
/api/email	A	POST /invoice, POST /send, GET /test
/api/upload	U / A	POST / (U); POST /test, GET /stats, DELETE /delete, POST /presigned-url, POST /cleanup, DELETE /bulk-delete (A)

Rate limits apply to every route: 300 requests per minute per IP, with the stricter limits noted above.