{
"info": {
"name": "OSA Admin Dashboard API",
"description": "Executable contract for the OSA multi-tenant admin dashboard API. Must stay in sync with api/routes/api.php and admin/src/app/core/services/api/endpoints.ts.\n\nVariables:\n- baseUrl: API base incl. /api\n- tenant: X-Tenant slug for tenant-portal calls\n- accessToken / refreshToken: tenant user JWT (set by Login)\n- adminToken: super-admin JWT (set by Admin Login)\n- tenantId / roleId / userId: ids for path params",
"schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
},
"variable": [
{
"key": "baseUrl",
"value": "http://localhost:8000/api"
},
{
"key": "tenant",
"value": "acme"
},
{
"key": "accessToken",
"value": ""
},
{
"key": "refreshToken",
"value": ""
},
{
"key": "adminToken",
"value": ""
},
{
"key": "tenantId",
"value": "1"
},
{
"key": "roleId",
"value": "1"
},
{
"key": "userId",
"value": "1"
},
{
"key": "verifyEmailToken",
"value": ""
},
{
"key": "notificationId",
"value": ""
},
{
"key": "attachmentId",
"value": ""
},
{
"key": "attachmentToken",
"value": ""
},
{
"key": "branchId",
"value": "1"
},
{
"key": "stockLocationId",
"value": "1"
},
{
"key": "counterId",
"value": "1"
},
{
"key": "employeeId",
"value": "1"
},
{
"key": "uomId",
"value": "1"
},
{
"key": "taxClassId",
"value": "1"
},
{
"key": "taxRateId",
"value": "1"
},
{
"key": "exchangeRateId",
"value": "1"
},
{
"key": "currencyCode",
"value": "USD"
},
{
"key": "categoryId",
"value": "1"
},
{
"key": "brandId",
"value": "1"
},
{
"key": "productId",
"value": "1"
},
{
"key": "variantId",
"value": "1"
},
{
"key": "bomHeaderId",
"value": "1"
},
{
"key": "warrantyTemplateId",
"value": "1"
},
{
"key": "serialId",
"value": "1"
},
{
"key": "barcodeId",
"value": "1"
},
{
"key": "labelTemplateId",
"value": "1"
},
{
"key": "labelJobId",
"value": "1"
},
{
"key": "importBatchId",
"value": "1"
},
{
"key": "importType",
"value": "categories"
},
{
"key": "batchId",
"value": "1"
},
{
"key": "reservationId",
"value": "1"
},
{
"key": "supplierId",
"value": "1"
},
{
"key": "purchaseOrderId",
"value": "1"
},
{
"key": "productionOrderId",
"value": "1"
},
{
"key": "stockRequestId",
"value": "1"
},
{
"key": "stockTransferId",
"value": "1"
},
{
"key": "stockAdjustmentId",
"value": "1"
},
{
"key": "stockCountId",
"value": "1"
},
{
"key": "goodsReceiptId",
"value": "1"
},
{
"key": "landedCostId",
"value": "1"
},
{
"key": "supplierInvoiceId",
"value": "1"
},
{
"key": "supplierReturnId",
"value": "1"
},
{
"key": "supplierPaymentId",
"value": "1"
}
],
"item": [
{
"name": "Health",
"item": [
{
"name": "Health check",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
}
],
"url": {
"raw": "{{baseUrl}}/health",
"host": [
"{{baseUrl}}"
],
"path": [
"health"
]
}
}
}
]
},
{
"name": "Tenant Auth",
"item": [
{
"name": "Login",
"event": [
{
"listen": "test",
"script": {
"type": "text/javascript",
"exec": [
"const res = pm.response.json();",
"if (res.data && res.data.token) {",
" pm.collectionVariables.set('accessToken', res.data.token);",
"}",
"pm.test('login ok', () => pm.response.code === 200);"
]
}
}
],
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"email\": \"admin@acme.test\",\n \"password\": \"password\"\n}"
},
"url": {
"raw": "{{baseUrl}}/auth/login",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"login"
]
}
}
},
{
"name": "Register",
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"name\": \"New User\",\n \"email\": \"new@acme.test\",\n \"password\": \"Password123\",\n \"password_confirmation\": \"Password123\",\n \"mobile\": \"0400000000\"\n}"
},
"url": {
"raw": "{{baseUrl}}/auth/register",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"register"
]
}
}
},
{
"name": "Me",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/auth/me",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"me"
]
}
}
},
{
"name": "Get Profile",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/auth/profile",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"profile"
]
}
}
},
{
"name": "Update Profile",
"request": {
"method": "PUT",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
},
{
"key": "Content-Type",
"value": "application/json"
}
],
"url": {
"raw": "{{baseUrl}}/auth/profile",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"profile"
]
},
"body": {
"mode": "raw",
"raw": "{\n \"full_name\": \"Acme Admin\",\n \"contact_no\": \"+94 77 000 0000\",\n \"user_name\": \"acme.admin\"\n}"
}
}
},
{
"name": "Refresh",
"event": [
{
"listen": "test",
"script": {
"type": "text/javascript",
"exec": [
"const res = pm.response.json();",
"if (res.data && res.data.token) { pm.collectionVariables.set('accessToken', res.data.token); }"
]
}
}
],
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/auth/refresh",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"refresh"
]
}
}
},
{
"name": "Change Password",
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"new_password\": \"NewPass123\",\n \"new_password_confirmation\": \"NewPass123\"\n}"
},
"url": {
"raw": "{{baseUrl}}/auth/change-password",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"change-password"
]
}
}
},
{
"name": "Update Theme",
"request": {
"method": "PUT",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"theme\": {\n \"LAYOUT_MODE\": \"dark\",\n \"DATA_LAYOUT\": \"vertical\",\n \"LAYOUT_WIDTH\": \"fluid\",\n \"SIDEBAR_MODE\": \"brand\",\n \"TOPBAR_TYPE\": \"brand\",\n \"LAYOUT_POSITION\": false,\n \"SIDEBAR_SIZE\": \"lg\"\n }\n}"
},
"url": {
"raw": "{{baseUrl}}/auth/theme",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"theme"
]
}
}
},
{
"name": "Forgot Password",
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"email\": \"admin@acme.test\"\n}"
},
"url": {
"raw": "{{baseUrl}}/auth/forgot-password",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"forgot-password"
]
}
}
},
{
"name": "Reset Password",
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"token\": \"RESET_TOKEN\",\n \"email\": \"admin@acme.test\",\n \"password\": \"NewPass123!\",\n \"password_confirmation\": \"NewPass123!\"\n}"
},
"url": {
"raw": "{{baseUrl}}/auth/reset-password",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"reset-password"
]
}
}
},
{
"name": "Get Invitation",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
}
],
"url": {
"raw": "{{baseUrl}}/auth/invitation?token=INVITE_TOKEN&email=invitee@acme.test",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"invitation"
],
"query": [
{
"key": "token",
"value": "INVITE_TOKEN"
},
{
"key": "email",
"value": "invitee@acme.test"
}
]
}
}
},
{
"name": "Accept Invitation",
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"token\": \"INVITE_TOKEN\",\n \"email\": \"invitee@acme.test\",\n \"password\": \"Str0ng!Pass\",\n \"password_confirmation\": \"Str0ng!Pass\"\n}"
},
"url": {
"raw": "{{baseUrl}}/auth/accept-invitation",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"accept-invitation"
]
}
}
},
{
"name": "2FA Status",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/auth/2fa/status",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"2fa",
"status"
]
}
}
},
{
"name": "2FA Enable",
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/auth/2fa/enable",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"2fa",
"enable"
]
}
}
},
{
"name": "2FA Confirm",
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"code\": \"123456\"\n}"
},
"url": {
"raw": "{{baseUrl}}/auth/2fa/confirm",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"2fa",
"confirm"
]
}
}
},
{
"name": "2FA Disable",
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"code\": \"123456\"\n}"
},
"url": {
"raw": "{{baseUrl}}/auth/2fa/disable",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"2fa",
"disable"
]
}
}
},
{
"name": "2FA Verify (login challenge)",
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"mfa_token\": \"MFA_TOKEN_FROM_LOGIN\",\n \"code\": \"123456\"\n}"
},
"url": {
"raw": "{{baseUrl}}/auth/2fa/verify",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"2fa",
"verify"
]
}
}
},
{
"name": "List Sessions",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/auth/sessions",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"sessions"
]
}
}
},
{
"name": "Revoke Other Sessions",
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/auth/sessions/revoke-others",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"sessions",
"revoke-others"
]
}
}
},
{
"name": "Revoke Session",
"request": {
"method": "DELETE",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/auth/sessions/{{sessionId}}",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"sessions",
"{{sessionId}}"
]
}
}
},
{
"name": "Logout",
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/auth/logout",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"logout"
]
}
}
},
{
"name": "Verify email",
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Content-Type",
"value": "application/json"
}
],
"url": {
"raw": "{{baseUrl}}/auth/verify-email",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"verify-email"
]
},
"body": {
"mode": "raw",
"raw": "{\n \"token\": \"{{verifyEmailToken}}\"\n}"
},
"description": "Public — the encrypted token from the emailed link proves identity."
}
},
{
"name": "Resend verification",
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
},
{
"key": "Content-Type",
"value": "application/json"
}
],
"url": {
"raw": "{{baseUrl}}/auth/resend-verification",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"resend-verification"
]
},
"body": {
"mode": "raw",
"raw": "{}"
}
}
},
{
"name": "Upload avatar",
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/auth/avatar",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"avatar"
]
},
"description": "multipart/form-data: field `avatar` (image, max 2MB), or `remove_avatar=1` to clear."
}
},
{
"name": "List notifications",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/auth/notifications?filter=all&per_page=15",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"notifications"
],
"query": [
{
"key": "filter",
"value": "all",
"disabled": true
},
{
"key": "per_page",
"value": "15",
"disabled": true
}
]
}
}
},
{
"name": "Unread notification count",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/auth/notifications/unread-count",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"notifications",
"unread-count"
]
}
}
},
{
"name": "Mark notification read",
"request": {
"method": "PATCH",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
},
{
"key": "Content-Type",
"value": "application/json"
}
],
"url": {
"raw": "{{baseUrl}}/auth/notifications/{{notificationId}}/read",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"notifications",
"{{notificationId}}",
"read"
]
},
"body": {
"mode": "raw",
"raw": "{}"
}
}
},
{
"name": "Mark all notifications read",
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
},
{
"key": "Content-Type",
"value": "application/json"
}
],
"url": {
"raw": "{{baseUrl}}/auth/notifications/read-all",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"notifications",
"read-all"
]
},
"body": {
"mode": "raw",
"raw": "{}"
}
}
},
{
"name": "Delete notification",
"request": {
"method": "DELETE",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/auth/notifications/{{notificationId}}",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"notifications",
"{{notificationId}}"
]
}
}
},
{
"name": "Clear notifications",
"request": {
"method": "DELETE",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/auth/notifications",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"notifications"
]
}
}
},
{
"name": "Branches (switchable)",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/auth/branches",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"branches"
]
}
}
},
{
"name": "Switch Branch",
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/auth/branch",
"host": [
"{{baseUrl}}"
],
"path": [
"auth",
"branch"
]
},
"body": {
"mode": "raw",
"raw": "{\n \"branch_id\": \"{{branchId}}\"\n}",
"options": {
"raw": {
"language": "json"
}
}
}
}
}
]
},
{
"name": "Admin - Auth",
"item": [
{
"name": "Admin Login",
"event": [
{
"listen": "test",
"script": {
"type": "text/javascript",
"exec": [
"const res = pm.response.json();",
"if (res.data && res.data.token) { pm.collectionVariables.set('adminToken', res.data.token); }",
"pm.test('admin login ok', () => pm.response.code === 200);"
]
}
}
],
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Content-Type",
"value": "application/json"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"email\": \"admin@example.com\",\n \"password\": \"password\"\n}"
},
"url": {
"raw": "{{baseUrl}}/admin/auth/login",
"host": [
"{{baseUrl}}"
],
"path": [
"admin",
"auth",
"login"
]
}
}
},
{
"name": "Admin Me",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Authorization",
"value": "Bearer {{adminToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/admin/auth/me",
"host": [
"{{baseUrl}}"
],
"path": [
"admin",
"auth",
"me"
]
}
}
},
{
"name": "Admin Update Theme",
"request": {
"method": "PUT",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "Authorization",
"value": "Bearer {{adminToken}}"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"theme\": {\n \"LAYOUT_MODE\": \"dark\",\n \"DATA_LAYOUT\": \"vertical\",\n \"LAYOUT_WIDTH\": \"fluid\",\n \"SIDEBAR_MODE\": \"brand\",\n \"TOPBAR_TYPE\": \"brand\",\n \"LAYOUT_POSITION\": false,\n \"SIDEBAR_SIZE\": \"lg\"\n }\n}"
},
"url": {
"raw": "{{baseUrl}}/admin/auth/theme",
"host": [
"{{baseUrl}}"
],
"path": [
"admin",
"auth",
"theme"
]
}
}
},
{
"name": "Admin Refresh",
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Authorization",
"value": "Bearer {{adminToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/admin/auth/refresh",
"host": [
"{{baseUrl}}"
],
"path": [
"admin",
"auth",
"refresh"
]
}
}
},
{
"name": "Admin Logout",
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Authorization",
"value": "Bearer {{adminToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/admin/auth/logout",
"host": [
"{{baseUrl}}"
],
"path": [
"admin",
"auth",
"logout"
]
}
}
}
]
},
{
"name": "Admin - Tenants",
"item": [
{
"name": "List Tenants",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Authorization",
"value": "Bearer {{adminToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/admin/tenants?per_page=25",
"host": [
"{{baseUrl}}"
],
"path": [
"admin",
"tenants"
],
"query": [
{
"key": "per_page",
"value": "25"
},
{
"key": "search",
"value": "",
"disabled": true
}
]
}
}
},
{
"name": "Create Tenant",
"event": [
{
"listen": "test",
"script": {
"type": "text/javascript",
"exec": [
"const res = pm.response.json();",
"if (res.data && res.data.id) { pm.collectionVariables.set('tenantId', res.data.id); }"
]
}
}
],
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "Authorization",
"value": "Bearer {{adminToken}}"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"name\": \"Beta Inc\",\n \"slug\": \"beta\",\n \"db_driver\": \"sqlite\",\n \"admin_name\": \"Beta Admin\",\n \"admin_email\": \"admin@beta.test\",\n \"admin_password\": \"password123\"\n}"
},
"url": {
"raw": "{{baseUrl}}/admin/tenants",
"host": [
"{{baseUrl}}"
],
"path": [
"admin",
"tenants"
]
}
}
},
{
"name": "Get Tenant",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Authorization",
"value": "Bearer {{adminToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/admin/tenants/{{tenantId}}",
"host": [
"{{baseUrl}}"
],
"path": [
"admin",
"tenants",
"{{tenantId}}"
]
}
}
},
{
"name": "Update Tenant",
"request": {
"method": "PUT",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "Authorization",
"value": "Bearer {{adminToken}}"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"name\": \"Beta Incorporated\",\n \"domain\": \"beta.example.com\"\n}"
},
"url": {
"raw": "{{baseUrl}}/admin/tenants/{{tenantId}}",
"host": [
"{{baseUrl}}"
],
"path": [
"admin",
"tenants",
"{{tenantId}}"
]
}
}
},
{
"name": "Set Status",
"request": {
"method": "PATCH",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "Authorization",
"value": "Bearer {{adminToken}}"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"status\": \"suspended\"\n}"
},
"url": {
"raw": "{{baseUrl}}/admin/tenants/{{tenantId}}/status",
"host": [
"{{baseUrl}}"
],
"path": [
"admin",
"tenants",
"{{tenantId}}",
"status"
]
}
}
},
{
"name": "Migrate Tenant",
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Authorization",
"value": "Bearer {{adminToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/admin/tenants/{{tenantId}}/migrate",
"host": [
"{{baseUrl}}"
],
"path": [
"admin",
"tenants",
"{{tenantId}}",
"migrate"
]
}
}
},
{
"name": "Tenant Users",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Authorization",
"value": "Bearer {{adminToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/admin/tenants/{{tenantId}}/users",
"host": [
"{{baseUrl}}"
],
"path": [
"admin",
"tenants",
"{{tenantId}}",
"users"
]
}
}
},
{
"name": "Enter Organisation (full access)",
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "Authorization",
"value": "Bearer {{adminToken}}"
}
],
"body": {
"mode": "raw",
"raw": "{}"
},
"url": {
"raw": "{{baseUrl}}/admin/tenants/{{tenantId}}/impersonate",
"host": [
"{{baseUrl}}"
],
"path": [
"admin",
"tenants",
"{{tenantId}}",
"impersonate"
]
},
"description": "Enter the organisation itself. With no user_id/email the session is granted every permission in the catalogue (imp_all claim), so the admin is not limited by whichever roles the underlying account holds. Still bound by the tenant's enabled modules."
}
},
{
"name": "Impersonate One User",
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "Authorization",
"value": "Bearer {{adminToken}}"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"user_id\": {{userId}}\n}"
},
"url": {
"raw": "{{baseUrl}}/admin/tenants/{{tenantId}}/impersonate",
"host": [
"{{baseUrl}}"
],
"path": [
"admin",
"tenants",
"{{tenantId}}",
"impersonate"
]
},
"description": "Sign in AS a specific tenant user, limited to exactly their permissions. Use this to reproduce one person's problem — not to administer the tenant."
}
},
{
"name": "Delete Tenant",
"request": {
"method": "DELETE",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "Authorization",
"value": "Bearer {{adminToken}}"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"drop_database\": true\n}"
},
"url": {
"raw": "{{baseUrl}}/admin/tenants/{{tenantId}}",
"host": [
"{{baseUrl}}"
],
"path": [
"admin",
"tenants",
"{{tenantId}}"
]
}
}
},
{
"name": "Admin activity logs",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Authorization",
"value": "Bearer {{adminToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/admin/activity-logs?per_page=25&event=&tenant_slug=",
"host": [
"{{baseUrl}}"
],
"path": [
"admin",
"activity-logs"
],
"query": [
{
"key": "per_page",
"value": "25",
"disabled": true
},
{
"key": "event",
"value": "",
"disabled": true
},
{
"key": "tenant_slug",
"value": "",
"disabled": true
}
]
},
"description": "Super-admin audit trail (central DB)."
}
},
{
"name": "Module Catalogue",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Authorization",
"value": "Bearer {{adminToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/admin/modules",
"host": [
"{{baseUrl}}"
],
"path": [
"admin",
"modules"
]
},
"description": "Switchable feature areas. `core` entries are always on and cannot be disabled."
}
},
{
"name": "Set Tenant Modules",
"request": {
"method": "PUT",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Authorization",
"value": "Bearer {{adminToken}}"
},
{
"key": "Content-Type",
"value": "application/json"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"modules\": [\n \"users\",\n \"roles\",\n \"settings\"\n ]\n}"
},
"url": {
"raw": "{{baseUrl}}/admin/tenants/{{tenantId}}/modules",
"host": [
"{{baseUrl}}"
],
"path": [
"admin",
"tenants",
"{{tenantId}}",
"modules"
]
},
"description": "Send the COMPLETE enabled set, not a delta. Core modules are forced back on; unknown codes are rejected (422)."
}
}
]
},
{
"name": "RBAC",
"item": [
{
"name": "Catalogue",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/rbac/catalogue",
"host": [
"{{baseUrl}}"
],
"path": [
"rbac",
"catalogue"
]
}
}
},
{
"name": "List Roles",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/rbac/roles",
"host": [
"{{baseUrl}}"
],
"path": [
"rbac",
"roles"
]
}
}
},
{
"name": "Create Role",
"event": [
{
"listen": "test",
"script": {
"type": "text/javascript",
"exec": [
"const res = pm.response.json();",
"if (res.data && res.data.id) { pm.collectionVariables.set('roleId', res.data.id); }"
]
}
}
],
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"name\": \"Editor\",\n \"permissions\": [\"users.view\", \"settings.view\", \"settings.update\"]\n}"
},
"url": {
"raw": "{{baseUrl}}/rbac/roles",
"host": [
"{{baseUrl}}"
],
"path": [
"rbac",
"roles"
]
}
}
},
{
"name": "Update Role",
"request": {
"method": "PUT",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"name\": \"Senior Editor\",\n \"permissions\": [\"users.view\", \"users.update\", \"settings.view\"]\n}"
},
"url": {
"raw": "{{baseUrl}}/rbac/roles/{{roleId}}",
"host": [
"{{baseUrl}}"
],
"path": [
"rbac",
"roles",
"{{roleId}}"
]
}
}
},
{
"name": "Delete Role",
"request": {
"method": "DELETE",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/rbac/roles/{{roleId}}",
"host": [
"{{baseUrl}}"
],
"path": [
"rbac",
"roles",
"{{roleId}}"
]
}
}
},
{
"name": "List Users",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/rbac/users",
"host": [
"{{baseUrl}}"
],
"path": [
"rbac",
"users"
]
}
}
},
{
"name": "Assign Roles",
"request": {
"method": "PUT",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"roles\": [{{roleId}}]\n}"
},
"url": {
"raw": "{{baseUrl}}/rbac/users/{{userId}}/roles",
"host": [
"{{baseUrl}}"
],
"path": [
"rbac",
"users",
"{{userId}}",
"roles"
]
}
}
},
{
"name": "Create User",
"event": [
{
"listen": "test",
"script": {
"type": "text/javascript",
"exec": [
"const res = pm.response.json();",
"if (res.data && res.data.id) { pm.collectionVariables.set('userId', res.data.id); }"
]
}
}
],
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"full_name\": \"New Member\",\n \"email\": \"member@acme.test\",\n \"password\": \"Password123\",\n \"roles\": []\n}"
},
"url": {
"raw": "{{baseUrl}}/rbac/users",
"host": [
"{{baseUrl}}"
],
"path": [
"rbac",
"users"
]
}
}
},
{
"name": "Get User",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/rbac/users/{{userId}}",
"host": [
"{{baseUrl}}"
],
"path": [
"rbac",
"users",
"{{userId}}"
]
}
}
},
{
"name": "Update User",
"request": {
"method": "PUT",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"full_name\": \"Renamed Member\"\n}"
},
"url": {
"raw": "{{baseUrl}}/rbac/users/{{userId}}",
"host": [
"{{baseUrl}}"
],
"path": [
"rbac",
"users",
"{{userId}}"
]
}
}
},
{
"name": "Set User Status",
"request": {
"method": "PATCH",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"status\": 0\n}"
},
"url": {
"raw": "{{baseUrl}}/rbac/users/{{userId}}/status",
"host": [
"{{baseUrl}}"
],
"path": [
"rbac",
"users",
"{{userId}}",
"status"
]
}
}
},
{
"name": "Get User Permissions",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/rbac/users/{{userId}}/permissions",
"host": [
"{{baseUrl}}"
],
"path": [
"rbac",
"users",
"{{userId}}",
"permissions"
]
}
}
},
{
"name": "Set User Permissions",
"request": {
"method": "PUT",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"overrides\": [\n { \"code\": \"users.view\", \"granted\": true },\n { \"code\": \"users.delete\", \"granted\": false }\n ]\n}"
},
"url": {
"raw": "{{baseUrl}}/rbac/users/{{userId}}/permissions",
"host": [
"{{baseUrl}}"
],
"path": [
"rbac",
"users",
"{{userId}}",
"permissions"
]
}
}
},
{
"name": "Delete User",
"request": {
"method": "DELETE",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/rbac/users/{{userId}}",
"host": [
"{{baseUrl}}"
],
"path": [
"rbac",
"users",
"{{userId}}"
]
}
}
},
{
"name": "Invite User",
"event": [
{
"listen": "test",
"script": {
"type": "text/javascript",
"exec": [
"const res = pm.response.json();",
"if (res.data && res.data.id) { pm.collectionVariables.set('invitationId', res.data.id); }"
]
}
}
],
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "Content-Type",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"body": {
"mode": "raw",
"raw": "{\n \"full_name\": \"Invited User\",\n \"email\": \"invitee@acme.test\",\n \"role_id\": {{roleId}}\n}"
},
"url": {
"raw": "{{baseUrl}}/rbac/users/invite",
"host": [
"{{baseUrl}}"
],
"path": [
"rbac",
"users",
"invite"
]
}
}
},
{
"name": "List Invitations",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/rbac/invitations",
"host": [
"{{baseUrl}}"
],
"path": [
"rbac",
"invitations"
]
}
}
},
{
"name": "Resend Invitation",
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/rbac/invitations/{{invitationId}}/resend",
"host": [
"{{baseUrl}}"
],
"path": [
"rbac",
"invitations",
"{{invitationId}}",
"resend"
]
}
}
},
{
"name": "Revoke Invitation",
"request": {
"method": "DELETE",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/rbac/invitations/{{invitationId}}",
"host": [
"{{baseUrl}}"
],
"path": [
"rbac",
"invitations",
"{{invitationId}}"
]
}
}
},
{
"name": "Activity & Audit Logs",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/rbac/activity-logs?log_type=audit",
"host": [
"{{baseUrl}}"
],
"path": [
"rbac",
"activity-logs"
],
"query": [
{
"key": "log_type",
"value": "audit"
}
]
}
}
},
{
"name": "Export users (CSV)",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/rbac/users/export?search=&status=",
"host": [
"{{baseUrl}}"
],
"path": [
"rbac",
"users",
"export"
],
"query": [
{
"key": "search",
"value": "",
"disabled": true
},
{
"key": "status",
"value": "",
"disabled": true
}
]
},
"description": "Streams text/csv for the current filter set (permission: users.export)."
}
},
{
"name": "List deleted users",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/rbac/users/trashed?search=&per_page=10",
"host": [
"{{baseUrl}}"
],
"path": [
"rbac",
"users",
"trashed"
],
"query": [
{
"key": "search",
"value": "",
"disabled": true
},
{
"key": "per_page",
"value": "10",
"disabled": true
}
]
}
}
},
{
"name": "Restore user",
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
},
{
"key": "Content-Type",
"value": "application/json"
}
],
"url": {
"raw": "{{baseUrl}}/rbac/users/{{userId}}/restore",
"host": [
"{{baseUrl}}"
],
"path": [
"rbac",
"users",
"{{userId}}",
"restore"
]
},
"body": {
"mode": "raw",
"raw": "{}"
}
}
},
{
"name": "Permanently delete user",
"request": {
"method": "DELETE",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/rbac/users/{{userId}}/force",
"host": [
"{{baseUrl}}"
],
"path": [
"rbac",
"users",
"{{userId}}",
"force"
]
},
"description": "Frees the email address; a soft-deleted user still holds it in the unique index."
}
},
{
"name": "Bulk user action",
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
},
{
"key": "Content-Type",
"value": "application/json"
}
],
"url": {
"raw": "{{baseUrl}}/rbac/users/bulk",
"host": [
"{{baseUrl}}"
],
"path": [
"rbac",
"users",
"bulk"
]
},
"body": {
"mode": "raw",
"raw": "{\n \"action\": \"deactivate\",\n \"ids\": [\n 2,\n 3\n ]\n}"
},
"description": "action: activate | deactivate | delete. The caller's own id is always skipped."
}
},
{
"name": "Export activity logs (CSV)",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/rbac/activity-logs/export?log_type=audit&from=&to=",
"host": [
"{{baseUrl}}"
],
"path": [
"rbac",
"activity-logs",
"export"
],
"query": [
{
"key": "log_type",
"value": "audit"
},
{
"key": "from",
"value": "",
"disabled": true
},
{
"key": "to",
"value": "",
"disabled": true
}
]
},
"description": "permission: logs.export"
}
}
]
},
{
"name": "Dashboard",
"item": [
{
"name": "Dashboard stats",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/dashboard/stats",
"host": [
"{{baseUrl}}"
],
"path": [
"dashboard",
"stats"
]
}
}
}
]
},
{
"name": "Attachments",
"item": [
{
"name": "List attachments",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/attachments?attachable_type=user&attachable_id=1&collection=default&unattached=1",
"host": [
"{{baseUrl}}"
],
"path": [
"attachments"
],
"query": [
{
"key": "attachable_type",
"value": "user",
"disabled": true
},
{
"key": "attachable_id",
"value": "1",
"disabled": true
},
{
"key": "collection",
"value": "default",
"disabled": true
},
{
"key": "unattached",
"value": "1",
"disabled": true
}
]
},
"description": "Filter by owning record, or pass unattached=1 for draft uploads."
}
},
{
"name": "Upload files",
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/attachments",
"host": [
"{{baseUrl}}"
],
"path": [
"attachments"
]
},
"body": {
"mode": "formdata",
"formdata": [
{
"key": "files[]",
"type": "file",
"src": []
},
{
"key": "attachable_type",
"value": "user",
"type": "text",
"disabled": true
},
{
"key": "attachable_id",
"value": "1",
"type": "text",
"disabled": true
},
{
"key": "collection",
"value": "default",
"type": "text",
"disabled": true
}
]
},
"description": "multipart/form-data. Omit attachable_* to park the upload as a draft, then claim it with /attachments/attach. Type is checked on BOTH extension and detected MIME (config/attachments.php)."
}
},
{
"name": "Attach draft uploads",
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
},
{
"key": "Content-Type",
"value": "application/json"
}
],
"url": {
"raw": "{{baseUrl}}/attachments/attach",
"host": [
"{{baseUrl}}"
],
"path": [
"attachments",
"attach"
]
},
"body": {
"mode": "raw",
"raw": "{\n \"ids\": [\n 1\n ],\n \"attachable_type\": \"user\",\n \"attachable_id\": 1,\n \"collection\": \"default\"\n}"
},
"description": "Claims previously uploaded unattached files. Files already owned by a record are never re-assigned."
}
},
{
"name": "Show attachment",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/attachments/{{attachmentId}}",
"host": [
"{{baseUrl}}"
],
"path": [
"attachments",
"{{attachmentId}}"
]
}
}
},
{
"name": "Download attachment",
"request": {
"method": "GET",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
}
],
"url": {
"raw": "{{baseUrl}}/attachments/{{attachmentId}}/download?disposition=inline",
"host": [
"{{baseUrl}}"
],
"path": [
"attachments",
"{{attachmentId}}",
"download"
],
"query": [
{
"key": "disposition",
"value": "inline",
"disabled": true
}
]
},
"description": "Streams the file to an authenticated caller. Always Content-Disposition: attachment unless the type is on the inline allowlist."
}
},
{
"name": "Create download link",
"request": {
"method": "POST",
"header": [
{
"key": "Accept",
"value": "application/json"
},
{
"key": "X-Tenant",
"value": "{{tenant}}"
},
{
"key": "Authorization",
"value": "Bearer {{accessToken}}"
},
{
"key": "Content-Type",
"value": "application/json"
}
],
"url": {
"raw": "{{baseUrl}}/attachments/{{attachmentId}}/link",
"host": [
"{{baseUrl}}"
],
"path": [
"attachments",
"{{attachmentId}}",
"link"
]
},
"body": {
"mode": "raw",
"raw": "{\n \"disposition\": \"inline\"\n}"
},
"description": "Short-lived self-authorising URL for an ![]()
/