API Documentation Overview

Base URL: https://yourdomain.com/api/v1

Authentication: Laravel Sanctum (Bearer token)

Endpoints

Auth

• POST /auth/login — get token (body: email, password, device_name)
• POST /auth/register — register patient
• GET /auth/me — get current user (auth required)
• POST /auth/logout — revoke token (auth required)

Treatments (Public Read)

• GET /treatments — list (param: category)
• GET /treatments/{id} — detail

Patients (Auth Required)

• GET /patients — list (admin: all in clinic, patient: own only)
• POST /patients — create (staff only)
• GET /patients/{id} — detail
• PUT /patients/{id} — update
• DELETE /patients/{id} — delete (staff only)

Appointments (Auth Required)

• GET /appointments — list (param: date, status)
• POST /appointments — create
• GET /appointments/{id} — detail
• PUT /appointments/{id} — update
• POST /appointments/{id}/cancel — cancel (body: reason)
• DELETE /appointments/{id} — delete

Example Login Flow

# Login
curl -X POST https://yourdomain.com/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "admin@klinik.com",
    "password": "password",
    "device_name": "mobile-app"
  }'

# Response:
# {
#   "token": "1|XXXXXXXXXXX",
#   "user": {"id":1,"name":"Admin","email":"...","role":"owner"}
# }

# Use token
curl https://yourdomain.com/api/v1/patients \
  -H "Authorization: Bearer 1|XXXXXXXXXXX" \
  -H "Accept: application/json"

Rate Limiting

• Default: 60 requests/minute per token
• Login endpoint: 5 attempts/minute per IP

Error Format

{
  "message": "The given data was invalid.",
  "errors": {
    "field_name": ["validation message"]
  }
}

RBAC di API

• Patient role → hanya bisa GET data sendiri (auto-filter by user_id)
• Staff role → CRUD sesuai permission Spatie
• Unauthenticated → 401, kecuali endpoint public (/treatments)