Public — no token required

Request body

{
  "email": "superadmin@luvsweet.com",
  "password": "SuperAdmin@123"
}

Response 200

{
  "status": "success",
  "message": "Login successful.",
  "data": {
    "token": {
      "access_token": "eyJ0eXAiOiJKV1Qi...",
      "token_type": "Bearer",
      "expires_in": 28800,
      "expires_at": "2026-06-10T16:12:03+00:00"
    },
    "admin": {
      "id": 1, "name": "Super Admin",
      "email": "superadmin@luvsweet.com",
      "role_id": 1, "role_name": "Super Admin",
      "is_super_admin": true
    },
    "permissions": ["*"]
  }
}

cURL

curl -X POST http://localhost:8080/api/admin/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"superadmin@luvsweet.com","password":"SuperAdmin@123"}'

Requires authentication

Response 200

{
  "status": "success",
  "data": {
    "admin": { "id": 1, "name": "Super Admin", "is_super_admin": true, ... },
    "permissions": ["*"]
  }
}

Requires authentication

Request body

Requires authentication

admin_users.view

Query parameters

Response 200 (with pagination meta)

{
  "status": "success",
  "data": [ { "id": 1, "name": "Super Admin", "role_name": "Super Admin", ... } ],
  "meta": { "current_page": 1, "per_page": 15, "total": 1, "total_pages": 1 }
}

admin_users.view

admin_users.create

Request body

{
  "name": "Ravi Kumar",
  "email": "ravi@luvsweet.com",
  "mobile": "9888877766",
  "password": "Ravi@12345",
  "role_id": 2
}

admin_users.update

All fields optional — send only what changes. Include password to reset it (min 8 chars).

admin_users.update

Request body

{ "status": "BLOCKED" }   // ACTIVE | INACTIVE | BLOCKED

admin_users.delete

roles.view

Optional ?search= filters by role name. Each role includes users_count and permissions_count.

roles.view

{
  "data": {
    "id": 2, "role_name": "Order Manager", "is_active": "1",
    "users_count": 3,
    "permission_ids": [1, 21, 22],
    "permission_keys": ["dashboard.view", "orders.view", "orders.update"]
  }
}

roles.create

{
  "role_name": "Order Manager",
  "description": "Handles orders & fulfilment",
  "permission_ids": [1, 21, 22]
}

roles.update

Accepts role_name, description, is_active and/or permission_ids (replaces the set when provided).

roles.update

{ "permission_ids": [1, 5, 6, 21] }

All listed ids must exist or the request fails with 422. The previous set is fully replaced.

roles.delete

permissions.view

Add ?grouped=1 to receive permissions grouped by module_name — ideal for rendering a role-editor checklist.

permissions.view

permissions.manage

permissions.manage

permissions.manage

products.createproducts.updatecategories.createcategories.update (any one)

Content-Type: multipart/form-data.

Form fields

* Provide at least one of file or files[].

Response 201

{
  "status": "success",
  "message": "File(s) uploaded successfully.",
  "data": {
    "folder": "products",
    "files": [
      {
        "url": "https://<cloudfront>/uploads/products/2026/06/ab12...png",
        "key": "uploads/products/2026/06/ab12...png",
        "original_name": "hero.png",
        "size": 20480, "mime": "image/png"
      }
    ]
  }
}

cURL

curl -X POST http://localhost:8080/api/admin/media/upload \
  -H "Authorization: Bearer <token>" \
  -F "folder=products" \
  -F "file=@/path/to/hero.png"

categories.view

Query parameters

categories.view

Includes children_count and products_count.

categories.create

Accepts JSON (with image_url) or multipart/form-data with an image file (uploaded to S3 automatically).

{
  "name": "Sugar Free",
  "parent_id": 1,
  "image_url": "https://<cloudfront>/uploads/categories/2026/06/ab.png",
  "sort_order": 5
}

categories.update

All fields optional. Supports the same image direct-upload as create. A category cannot be set as its own parent.

categories.delete

products.view

Query parameters

Each row includes category_name and variants_count. Pagination is returned in meta.

products.view

Returns the product, its category_name, decoded nutrition_facts, the full variants[] array and the images[] gallery.

products.create

Entity mapping

Product fields

Variant fields (per item in variants[])

{
  "category_id": 1,
  "name": "LuvSweet Stevia Drops",
  "nutrition_facts": { "calories": 0, "sugar": "0g" },
  "is_featured": 1,
  "featured_image_url": "https://<cloudfront>/uploads/products/2026/06/hero.png",
  "variants": [
    { "sku": "LS-STV-30ML", "variant_name": "30ml", "pack_size": "30ml",
      "mrp": 199, "selling_price": 149, "gst_rate": 5, "stock_qty": 50, "product_visibility": "B2C" }
  ],
  "images": [
    { "image_url": "https://<cloudfront>/uploads/products/2026/06/g1.png", "alt_text": "front" }
  ]
}

products.update

Updates only the product's own fields (any subset). Variants and gallery images are intentionally managed through their dedicated endpoints below.

products.update

{ "is_active": 0 }   // 0 = inactive, 1 = active

products.delete

products.update

Body = a single variant object (same fields as in the create payload). SKU must be unique.

products.update

Any subset of variant fields. The variant must belong to the given product.

products.update

products.update

Content-Type: multipart/form-data. Files are uploaded to S3 and gallery rows are created with auto-incrementing sort_order.

* At least one of files[] / file is required.

curl -X POST http://localhost:8080/api/admin/products/1/images \
  -H "Authorization: Bearer <token>" \
  -F "alt_text=hero shot" \
  -F "files[]=@front.png" -F "files[]=@back.png"

products.update

Removes the gallery row and deletes the underlying S3 object.

activity_logs.view

Every create / update / delete / status change and auth event is recorded automatically, including old & new values.

Query parameters