{ "info": { "name": "Masdar APIs", "description": "Complete, re-indexed collection of every PHP API endpoint in the masdar-apis project (rebuilt from the current codebase).\n\nFolder structure mirrors the code directory tree 1:1: each Postman folder corresponds to one directory under cms/, oms/, or web/, nested exactly the way the directories are nested (e.g. Blogs > Articles/Authors/Categories mirrors cms/blogs/{articles,authors,categories}/; Visits > New mirrors oms/visits/new/). Loose files that sit directly in a directory (not inside a subfolder) are direct child requests of that folder rather than being wrapped in an extra grouping folder.\n\nAuthentication model:\n- CMS (Admin API): every endpoint except Admin Login requires a Bearer token, enforced server-side via PrivilegeHelper::authorize() - both a valid JWT (from Admin Login) AND the admin's user type being granted the specific module/action privilege. The CMS folder has Bearer auth configured at the folder level using the {{access_token}} variable; running Admin Login auto-populates it via a test script, so every other CMS request works immediately afterward with no manual header editing.\n- OMS (Operations) and Web (Public API): no authentication or authorization is enforced on any endpoint (verified against the current source - no AuthHelper/PrivilegeHelper usage in either tree).\n\nSwitching environments (single-file, no separate imports needed): this collection variable base_url drives every request via {{base_url}}. To switch, open this collection's Variables tab and copy the value of local_base_url / staging_base_url / production_base_url into base_url (or just type a URL directly) - Local=http://localhost/projects/masdar-apis, Staging=https://apis-fe-uat.masdaronline.com, Production=https://apis-fe.masdaronline.com.\n\nMany create/update endpoints accept EITHER multipart/form-data (shown here, needed for file uploads) OR a raw JSON body - see each request's description for field-level notes pulled directly from the current PHP source.", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json" }, "variable": [ { "key": "base_url", "value": "http://localhost/projects/masdar-apis", "type": "string", "description": "ACTIVE base URL used by every request via {{base_url}}. Change this single value to switch environments (copy one of the three URLs below into it) - no need to import anything else." }, { "key": "local_base_url", "value": "http://localhost/projects/masdar-apis", "type": "string", "description": "Reference only, not used directly by requests. Copy into base_url to point requests at Local." }, { "key": "staging_base_url", "value": "https://apis-fe-uat.masdaronline.com", "type": "string", "description": "Reference only, not used directly by requests. Copy into base_url to point requests at Staging." }, { "key": "production_base_url", "value": "https://apis-fe.masdaronline.com", "type": "string", "description": "Reference only, not used directly by requests. Copy into base_url to point requests at Production." }, { "key": "access_token", "value": "", "type": "string", "description": "Auto-populated by the CMS > Admin Login request test script. Used as the Bearer token for every other CMS (Admin API) request." } ], "auth": { "type": "noauth" }, "item": [ { "name": "CMS (Admin API)", "item": [ { "name": "Admin Login", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/cms/login.php", "host": [ "{{base_url}}" ], "path": [ "cms", "login.php" ] }, "description": "Real DB-backed login against admins table. Accepts JSON {email, password}. Passwords verified with PHP password_verify() (bcrypt), legacy SHA-512 upgraded on success. Issues a JWT in data.access_token, HS256 signed with JWT_SECRET, containing admin_id/email/username/user_type_id/exp. This test script auto-saves the token into the {{access_token}} collection variable so every other CMS request (which inherits Bearer auth from the CMS folder) works immediately after running this.", "body": { "mode": "raw", "raw": "{\n \"email\": \"admin@masdar.com\",\n \"password\": \"password123\"\n}", "options": { "raw": { "language": "json" } } }, "auth": { "type": "noauth" } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "const res = pm.response.json();", "if (res && res.result === 1 && res.data && res.data.access_token) {", " pm.collectionVariables.set(\"access_token\", res.data.access_token);", " console.log(\"Saved access_token to collection variable.\");", "} else {", " console.warn(\"Login did not return an access_token - check credentials.\");", "}" ] } } ] }, { "name": "Logout", "request": { "method": "POST", "header": [], "url": { "raw": "{{base_url}}/cms/logout.php", "host": [ "{{base_url}}" ], "path": [ "cms", "logout.php" ] }, "description": "Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first. Auth here is pure stateless JWT (no server-side session/token store), so this endpoint cannot revoke the token itself; it authenticates the bearer token to identify the caller and writes a 'logout' entry to the audit log (user_log). The client is responsible for discarding the token afterward - this test script clears the {{access_token}} collection variable on success so subsequent requests correctly fail until Admin Login is run again." }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "const res = pm.response.json();", "if (res && res.result === 1) {", " pm.collectionVariables.set(\"access_token\", \"\");", " console.log(\"Cleared access_token collection variable.\");", "}" ] } } ] }, { "name": "About", "item": [ { "name": "Get About", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/cms/about/get.php", "host": [ "{{base_url}}" ], "path": [ "cms", "about", "get.php" ] }, "description": "Singleton row (id=1) from cms_about_us. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first." } }, { "name": "Update About", "request": { "method": "POST", "header": [], "url": { "raw": "{{base_url}}/cms/about/update.php", "host": [ "{{base_url}}" ], "path": [ "cms", "about", "update.php" ] }, "description": "Upserts singleton row id=1 in cms_about_us. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "formdata", "formdata": [ { "key": "subtitle_en", "value": "Leading the way", "type": "text", "description": "required" }, { "key": "subtitle_ar", "value": "نقود المستقبل", "type": "text", "description": "required" }, { "key": "title_en", "value": "About Masdar", "type": "text", "description": "required" }, { "key": "title_ar", "value": "عن مصدر", "type": "text", "description": "required" }, { "key": "description_en", "value": "Company description in English", "type": "text", "description": "required" }, { "key": "description_ar", "value": "وصف الشركة بالعربية", "type": "text", "description": "required" }, { "key": "image", "type": "file", "src": [], "description": "required, main hero image" }, { "key": "items", "value": "[{\"icon\":\"gallery/icons/existing_icon.svg\",\"value\":\"10+\",\"text_en\":\"Years of experience\",\"text_ar\":\"سنوات الخبرة\"}]", "type": "text", "description": "required, JSON array of {icon,value,text_en,text_ar}. To upload new icons per item, add file fields named items_icon_0, items_icon_1, ..." } ] } } } ], "description": "Privilege module: \"About Us\" (read/update). Directly under cms/ - no about_us/ module exists anymore, only about/." }, { "name": "Admin Privileges", "item": [ { "name": "Get Privileges For Admin Type", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/cms/admin_privileges/get.php?user_type_id=1", "host": [ "{{base_url}}" ], "path": [ "cms", "admin_privileges", "get.php" ], "query": [ { "key": "user_type_id", "value": "1", "description": "required", "disabled": false } ] }, "description": "Returns every row in functions_list joined with this admin type's grant flags (0 where no row exists yet). Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first." } }, { "name": "Save Privileges For Admin Type", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/cms/admin_privileges/save.php", "host": [ "{{base_url}}" ], "path": [ "cms", "admin_privileges", "save.php" ] }, "description": "Upserts the full privilege matrix for one user_type_id. access_publish is accepted but being phased out (PrivilegeHelper does not enforce it). Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "raw", "raw": "{\n \"user_type_id\": 1,\n \"privileges\": [\n {\n \"fct_id\": 1,\n \"access_read\": 1,\n \"access_write\": 1,\n \"access_edit\": 1,\n \"access_publish\": 0,\n \"access_delete\": 0\n },\n {\n \"fct_id\": 2,\n \"access_read\": 1,\n \"access_write\": 0,\n \"access_edit\": 0,\n \"access_publish\": 0,\n \"access_delete\": 0\n }\n ]\n}", "options": { "raw": { "language": "json" } } } } } ], "description": "Privilege module: \"User Privileges\". Manages the user_type_privileges matrix (functions_list x user_type)." }, { "name": "Admin Types", "item": [ { "name": "Create Admin Type", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/cms/admin_types/create.php", "host": [ "{{base_url}}" ], "path": [ "cms", "admin_types", "create.php" ] }, "description": "Table user_type. Name must be unique among non-deleted types. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "raw", "raw": "{\n \"type_name\": \"Content Editor\"\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Get Admin Types (List/Single)", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/cms/admin_types/get.php", "host": [ "{{base_url}}" ], "path": [ "cms", "admin_types", "get.php" ], "query": [ { "key": "id", "value": "1", "description": "optional - single vs list", "disabled": true }, { "key": "search", "value": "", "description": "optional, matches type_name", "disabled": true } ] }, "description": "Each row includes a computed admin_count (non-deleted admins of that type). Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first." } }, { "name": "Update Admin Type", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/cms/admin_types/update.php", "host": [ "{{base_url}}" ], "path": [ "cms", "admin_types", "update.php" ] }, "description": "Renames a type; rejects duplicate type_name. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "raw", "raw": "{\n \"id\": 1,\n \"type_name\": \"Content Editor\"\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Delete Admin Type", "request": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/cms/admin_types/delete.php", "host": [ "{{base_url}}" ], "path": [ "cms", "admin_types", "delete.php" ] }, "description": "Soft delete. Rejects if any non-deleted admin still uses this type. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "raw", "raw": "{\n \"id\": 1\n}", "options": { "raw": { "language": "json" } } } } } ], "description": "Privilege module: \"Admin Types\". Table user_type - the roles assignable to admins.php." }, { "name": "Admins", "item": [ { "name": "Create Admin", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/cms/admins/create.php", "host": [ "{{base_url}}" ], "path": [ "cms", "admins", "create.php" ] }, "description": "Table admins. Password hashed with password_hash() (bcrypt). Email must be unique among non-deleted admins. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "raw", "raw": "{\n \"username\": \"jdoe\",\n \"email\": \"jdoe@masdar.com\",\n \"fullname\": \"John Doe\",\n \"phone\": \"+966500000000\",\n \"user_type_id\": 1,\n \"password\": \"ChangeMe123!\",\n \"is_active\": 1,\n \"order_num\": 0\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Get Admins (List/Single)", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/cms/admins/get.php", "host": [ "{{base_url}}" ], "path": [ "cms", "admins", "get.php" ], "query": [ { "key": "id", "value": "1", "description": "optional - single vs list", "disabled": true }, { "key": "search", "value": "", "description": "optional, matches username/email/fullname/phone", "disabled": true }, { "key": "user_type_id", "value": "1", "description": "optional filter", "disabled": true } ] }, "description": "Joins user_type for user_type_name. Password hash is never returned. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first." } }, { "name": "Update Admin", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/cms/admins/update.php", "host": [ "{{base_url}}" ], "path": [ "cms", "admins", "update.php" ] }, "description": "Omit password to keep the current one; provide it (min 8 chars) to change it. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "raw", "raw": "{\n \"id\": 1,\n \"username\": \"jdoe\",\n \"email\": \"jdoe@masdar.com\",\n \"fullname\": \"John Doe\",\n \"phone\": \"+966500000000\",\n \"user_type_id\": 1,\n \"is_active\": 1,\n \"order_num\": 0\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Delete Admin", "request": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/cms/admins/delete.php", "host": [ "{{base_url}}" ], "path": [ "cms", "admins", "delete.php" ] }, "description": "Soft delete (deleted=1, is_active=0). Refuses to delete the last remaining active admin account. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "raw", "raw": "{\n \"id\": 1\n}", "options": { "raw": { "language": "json" } } } } } ], "description": "Privilege module: \"Admins\". Table admins - the CMS user accounts that can log in via cms/login.php." }, { "name": "Banners", "item": [ { "name": "Create Banner", "request": { "method": "POST", "header": [], "url": { "raw": "{{base_url}}/cms/banners/create.php", "host": [ "{{base_url}}" ], "path": [ "cms", "banners", "create.php" ] }, "description": "Inserts into cms_banners with is_deleted=0. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "formdata", "formdata": [ { "key": "banner_type", "value": "0", "type": "text", "description": "required, 0 or 1" }, { "key": "priority", "value": "1", "type": "text", "description": "required, unique per destination_page among active banners" }, { "key": "is_active", "value": "1", "type": "text", "description": "required, 0 or 1" }, { "key": "destination_page", "value": "0", "type": "text", "description": "required, one of 0|1|2|3|4" }, { "key": "is_promotional", "value": "0", "type": "text", "description": "required, 0 or 1" }, { "key": "promotion_name", "value": "Summer Sale", "type": "text", "description": "" }, { "key": "promotion_name_ar", "value": "تخفيضات الصيف", "type": "text", "description": "" }, { "key": "promotion_description", "value": "Up to 50% off", "type": "text", "description": "" }, { "key": "promotion_description_ar", "value": "خصم يصل الى 50%", "type": "text", "description": "" }, { "key": "link_en", "value": "https://example.com/en", "type": "text", "description": "" }, { "key": "link_ar", "value": "https://example.com/ar", "type": "text", "description": "" }, { "key": "button_text_en", "value": "Shop Now", "type": "text", "description": "" }, { "key": "button_text_ar", "value": "تسوق الآن", "type": "text", "description": "" }, { "key": "start_date", "value": "2026-08-01", "type": "text", "description": "" }, { "key": "end_date", "value": "2026-08-31", "type": "text", "description": "" }, { "key": "page_id", "value": "", "type": "text", "description": "" }, { "key": "image_en", "type": "file", "src": [], "description": "optional" }, { "key": "image_ar", "type": "file", "src": [], "description": "optional" }, { "key": "mobile_image_en", "type": "file", "src": [], "description": "optional" }, { "key": "mobile_image_ar", "type": "file", "src": [], "description": "optional" } ] } } }, { "name": "Get Banners", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/cms/banners/get.php", "host": [ "{{base_url}}" ], "path": [ "cms", "banners", "get.php" ] }, "description": "Lists non-deleted banners ordered by id DESC. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first." } }, { "name": "Update Banner", "request": { "method": "POST", "header": [], "url": { "raw": "{{base_url}}/cms/banners/update.php", "host": [ "{{base_url}}" ], "path": [ "cms", "banners", "update.php" ] }, "description": "Dynamic partial update - only supplied fields change. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "formdata", "formdata": [ { "key": "id", "value": "1", "type": "text", "description": "required" }, { "key": "priority", "value": "1", "type": "text", "description": "" }, { "key": "is_active", "value": "1", "type": "text", "description": "" }, { "key": "destination_page", "value": "0", "type": "text", "description": "" }, { "key": "is_promotional", "value": "0", "type": "text", "description": "" }, { "key": "promotion_name", "value": "Summer Sale", "type": "text", "description": "" }, { "key": "promotion_name_ar", "value": "تخفيضات الصيف", "type": "text", "description": "" }, { "key": "link_en", "value": "https://example.com/en", "type": "text", "description": "" }, { "key": "link_ar", "value": "https://example.com/ar", "type": "text", "description": "" }, { "key": "button_text_en", "value": "Shop Now", "type": "text", "description": "" }, { "key": "button_text_ar", "value": "تسوق الآن", "type": "text", "description": "" }, { "key": "start_date", "value": "2026-08-01", "type": "text", "description": "" }, { "key": "end_date", "value": "2026-08-31", "type": "text", "description": "" }, { "key": "image_en", "type": "file", "src": [], "description": "optional - omit to keep current" }, { "key": "image_ar", "type": "file", "src": [], "description": "optional" } ] } } }, { "name": "Delete Banner", "request": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/cms/banners/delete.php", "host": [ "{{base_url}}" ], "path": [ "cms", "banners", "delete.php" ] }, "description": "Soft delete (is_deleted=1). Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "raw", "raw": "{\n \"id\": 1\n}", "options": { "raw": { "language": "json" } } } } } ], "description": "Privilege module: \"Banners\". Table cms_banners." }, { "name": "Blogs", "item": [ { "name": "Articles", "item": [ { "name": "Create Article", "request": { "method": "POST", "header": [], "url": { "raw": "{{base_url}}/cms/blogs/articles/create.php", "host": [ "{{base_url}}" ], "path": [ "cms", "blogs", "articles", "create.php" ] }, "description": "Table blogsArticles. Slug auto-generated from title if left empty. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "formdata", "formdata": [ { "key": "category_id", "value": "1", "type": "text", "description": "required" }, { "key": "author_id", "value": "1", "type": "text", "description": "required, must exist in blogsAuthors" }, { "key": "title_en", "value": "My First Blog Post", "type": "text", "description": "required" }, { "key": "title_ar", "value": "أول تدوينة لي", "type": "text", "description": "required" }, { "key": "description_en", "value": "Full article body", "type": "text", "description": "" }, { "key": "description_ar", "value": "محتوى المقال", "type": "text", "description": "" }, { "key": "short_description_en", "value": "Short summary", "type": "text", "description": "" }, { "key": "short_description_ar", "value": "ملخص قصير", "type": "text", "description": "" }, { "key": "slug_en", "value": "", "type": "text", "description": "" }, { "key": "slug_ar", "value": "", "type": "text", "description": "" }, { "key": "read_time", "value": "5", "type": "text", "description": "" }, { "key": "is_active", "value": "1", "type": "text", "description": "" }, { "key": "active_on_home_screen", "value": "0", "type": "text", "description": "" }, { "key": "view_count", "value": "0", "type": "text", "description": "" }, { "key": "created_by", "value": "admin", "type": "text", "description": "" }, { "key": "images", "type": "file", "src": [], "description": "optional, multiple images" }, { "key": "related_items", "value": "[{\"product_id\":\"P001\",\"uom\":\"EA\"}]", "type": "text", "description": "optional JSON array" } ] } } }, { "name": "Get Articles", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/cms/blogs/articles/get.php", "host": [ "{{base_url}}" ], "path": [ "cms", "blogs", "articles", "get.php" ], "query": [ { "key": "search", "value": "", "description": "", "disabled": true }, { "key": "category_id", "value": "1", "description": "", "disabled": true }, { "key": "author_id", "value": "1", "description": "", "disabled": true }, { "key": "is_active", "value": "1", "description": "", "disabled": true }, { "key": "active_on_home_screen", "value": "1", "description": "", "disabled": true } ] }, "description": "Joins blogsCategories + blogsAuthors. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first." } }, { "name": "Update Article", "request": { "method": "POST", "header": [], "url": { "raw": "{{base_url}}/cms/blogs/articles/update.php", "host": [ "{{base_url}}" ], "path": [ "cms", "blogs", "articles", "update.php" ] }, "description": "Partial update - only supplied fields change. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "formdata", "formdata": [ { "key": "id", "value": "1", "type": "text", "description": "required" }, { "key": "title_en", "value": "Updated title", "type": "text", "description": "" }, { "key": "title_ar", "value": "عنوان محدث", "type": "text", "description": "" }, { "key": "description_en", "value": "Updated body", "type": "text", "description": "" }, { "key": "is_active", "value": "1", "type": "text", "description": "" }, { "key": "active_on_home_screen", "value": "0", "type": "text", "description": "" }, { "key": "images", "type": "file", "src": [], "description": "optional, replaces images" }, { "key": "updated_by", "value": "admin", "type": "text", "description": "" } ] } } }, { "name": "Delete Article", "request": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/cms/blogs/articles/delete.php", "host": [ "{{base_url}}" ], "path": [ "cms", "blogs", "articles", "delete.php" ] }, "description": "Soft delete (is_deleted=1). Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "raw", "raw": "{\n \"id\": 1\n}", "options": { "raw": { "language": "json" } } } } } ], "description": "Privilege module: \"Blog Articles\"." }, { "name": "Authors", "item": [ { "name": "Create Author", "request": { "method": "POST", "header": [], "url": { "raw": "{{base_url}}/cms/blogs/authors/create.php", "host": [ "{{base_url}}" ], "path": [ "cms", "blogs", "authors", "create.php" ] }, "description": "Table blogsAuthors. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "formdata", "formdata": [ { "key": "name_en", "value": "John Doe", "type": "text", "description": "required" }, { "key": "name_ar", "value": "جون دو", "type": "text", "description": "required" }, { "key": "description_en", "value": "", "type": "text", "description": "" }, { "key": "description_ar", "value": "", "type": "text", "description": "" }, { "key": "role_en", "value": "Editor", "type": "text", "description": "" }, { "key": "role_ar", "value": "محرر", "type": "text", "description": "" }, { "key": "image", "type": "file", "src": [], "description": "optional" } ] } } }, { "name": "Get Authors", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/cms/blogs/authors/get.php", "host": [ "{{base_url}}" ], "path": [ "cms", "blogs", "authors", "get.php" ], "query": [ { "key": "search", "value": "", "description": "", "disabled": true } ] }, "description": "Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first." } }, { "name": "Update Author", "request": { "method": "POST", "header": [], "url": { "raw": "{{base_url}}/cms/blogs/authors/update.php", "host": [ "{{base_url}}" ], "path": [ "cms", "blogs", "authors", "update.php" ] }, "description": "Partial update. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "formdata", "formdata": [ { "key": "id", "value": "1", "type": "text", "description": "required" }, { "key": "name_en", "value": "John Doe", "type": "text", "description": "" }, { "key": "name_ar", "value": "جون دو", "type": "text", "description": "" }, { "key": "image", "type": "file", "src": [], "description": "optional" } ] } } }, { "name": "Delete Author", "request": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/cms/blogs/authors/delete.php", "host": [ "{{base_url}}" ], "path": [ "cms", "blogs", "authors", "delete.php" ] }, "description": "Soft delete. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "raw", "raw": "{\n \"id\": 1\n}", "options": { "raw": { "language": "json" } } } } } ], "description": "Privilege module: \"Blog Authors\"." }, { "name": "Categories", "item": [ { "name": "Create Blog Category", "request": { "method": "POST", "header": [], "url": { "raw": "{{base_url}}/cms/blogs/categories/create.php", "host": [ "{{base_url}}" ], "path": [ "cms", "blogs", "categories", "create.php" ] }, "description": "Table blogsCategories. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "formdata", "formdata": [ { "key": "title_en", "value": "Technology", "type": "text", "description": "required" }, { "key": "title_ar", "value": "تقنية", "type": "text", "description": "required" }, { "key": "description_en", "value": "", "type": "text", "description": "" }, { "key": "description_ar", "value": "", "type": "text", "description": "" }, { "key": "parent_id", "value": "", "type": "text", "description": "optional, existing blogsCategories id or NULL" }, { "key": "slug_en", "value": "", "type": "text", "description": "" }, { "key": "slug_ar", "value": "", "type": "text", "description": "" }, { "key": "icon", "type": "file", "src": [], "description": "optional, SVG (sanitized server-side)" } ] } } }, { "name": "Get Blog Categories", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/cms/blogs/categories/get.php", "host": [ "{{base_url}}" ], "path": [ "cms", "blogs", "categories", "get.php" ], "query": [ { "key": "search", "value": "", "description": "", "disabled": true }, { "key": "parent_id", "value": "", "description": "", "disabled": true } ] }, "description": "Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first." } }, { "name": "Update Blog Category", "request": { "method": "POST", "header": [], "url": { "raw": "{{base_url}}/cms/blogs/categories/update.php", "host": [ "{{base_url}}" ], "path": [ "cms", "blogs", "categories", "update.php" ] }, "description": "Partial update, prevents self-parenting. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "formdata", "formdata": [ { "key": "id", "value": "1", "type": "text", "description": "required" }, { "key": "title_en", "value": "Technology", "type": "text", "description": "" }, { "key": "title_ar", "value": "تقنية", "type": "text", "description": "" }, { "key": "parent_id", "value": "", "type": "text", "description": "" }, { "key": "icon", "type": "file", "src": [], "description": "optional" } ] } } }, { "name": "Delete Blog Category", "request": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/cms/blogs/categories/delete.php", "host": [ "{{base_url}}" ], "path": [ "cms", "blogs", "categories", "delete.php" ] }, "description": "Soft delete. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "raw", "raw": "{\n \"id\": 1\n}", "options": { "raw": { "language": "json" } } } } } ], "description": "Privilege module: \"Blog Categories\"." } ], "description": "" }, { "name": "Brands", "item": [ { "name": "Get Brands", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/cms/brands/get.php", "host": [ "{{base_url}}" ], "path": [ "cms", "brands", "get.php" ] }, "description": "Table cms_brand_items. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first." } }, { "name": "Replace Brands (Bulk)", "request": { "method": "POST", "header": [], "url": { "raw": "{{base_url}}/cms/brands/update.php", "host": [ "{{base_url}}" ], "path": [ "cms", "brands", "update.php" ] }, "description": "WARNING: full-replace - deletes ALL rows in cms_brand_items then re-inserts this array. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "formdata", "formdata": [ { "key": "brands", "value": "[{\"icon\":\"gallery/icons/brand1.svg\",\"link_en\":\"https://brand1.com\",\"link_ar\":\"https://brand1.com/ar\",\"rank\":1,\"active_on_home_screen\":1}]", "type": "text", "description": "required, JSON array of {icon,link_en,link_ar,rank,active_on_home_screen}. To upload new icons use brands_icon_0, brands_icon_1, ... file fields" } ] } } } ], "description": "Privilege module: \"Brands\"." }, { "name": "Categories", "item": [ { "name": "Create Category", "request": { "method": "POST", "header": [], "url": { "raw": "{{base_url}}/cms/categories/create.php", "host": [ "{{base_url}}" ], "path": [ "cms", "categories", "create.php" ] }, "description": "Table cms_categories. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "formdata", "formdata": [ { "key": "content_id", "value": "electronics", "type": "text", "description": "required, unique" }, { "key": "content_title", "value": "Electronics", "type": "text", "description": "required" }, { "key": "content_title_ar", "value": "إلكترونيات", "type": "text", "description": "required" }, { "key": "is_active", "value": "1", "type": "text", "description": "required" }, { "key": "on_home_screen", "value": "1", "type": "text", "description": "required" }, { "key": "is_promotional", "value": "0", "type": "text", "description": "required" }, { "key": "parent_category", "value": "", "type": "text", "description": "required key (empty string for top-level)" }, { "key": "image_en", "type": "file", "src": [], "description": "optional" }, { "key": "image_ar", "type": "file", "src": [], "description": "optional" }, { "key": "icon", "type": "file", "src": [], "description": "optional, SVG (sanitized server-side)" } ] } } }, { "name": "Get CMS Categories", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/cms/categories/get_cms_categories.php", "host": [ "{{base_url}}" ], "path": [ "cms", "categories", "get_cms_categories.php" ], "query": [ { "key": "search", "value": "", "description": "", "disabled": true } ] }, "description": "All non-deleted categories. Note: get_parent_categories.php / get_parent_subcategories.php no longer exist here — use oms/categories or web/ equivalents for tree-shaped public queries. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first." } }, { "name": "Update Category", "request": { "method": "POST", "header": [], "url": { "raw": "{{base_url}}/cms/categories/update.php", "host": [ "{{base_url}}" ], "path": [ "cms", "categories", "update.php" ] }, "description": "Partial update. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "formdata", "formdata": [ { "key": "id", "value": "1", "type": "text", "description": "required" }, { "key": "content_title", "value": "Electronics", "type": "text", "description": "" }, { "key": "content_title_ar", "value": "إلكترونيات", "type": "text", "description": "" }, { "key": "is_active", "value": "1", "type": "text", "description": "" }, { "key": "image_en", "type": "file", "src": [], "description": "optional" }, { "key": "icon", "type": "file", "src": [], "description": "optional" } ] } } }, { "name": "Delete Category", "request": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/cms/categories/delete.php", "host": [ "{{base_url}}" ], "path": [ "cms", "categories", "delete.php" ] }, "description": "Soft delete. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "raw", "raw": "{\n \"id\": 1\n}", "options": { "raw": { "language": "json" } } } } } ], "description": "Privilege module: \"Categories\"." }, { "name": "Customer Registration", "item": [ { "name": "Create Customer Registration", "request": { "method": "POST", "header": [], "url": { "raw": "{{base_url}}/cms/customer_registration/create.php", "host": [ "{{base_url}}" ], "path": [ "cms", "customer_registration", "create.php" ] }, "description": "Table customer_registration - a CMS page-section/CTA block config (not customer-submitted leads). Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "formdata", "formdata": [ { "key": "title_en", "value": "Register Today", "type": "text", "description": "required" }, { "key": "title_ar", "value": "سجل اليوم", "type": "text", "description": "required" }, { "key": "description_en", "value": "Join now", "type": "text", "description": "required" }, { "key": "description_ar", "value": "انضم الآن", "type": "text", "description": "required" }, { "key": "icon", "type": "file", "src": [], "description": "required, SVG" }, { "key": "is_active", "value": "1", "type": "text", "description": "required" }, { "key": "button_text_en", "value": "Register", "type": "text", "description": "required" }, { "key": "button_text_ar", "value": "سجل", "type": "text", "description": "required" }, { "key": "button_url_en", "value": "/register", "type": "text", "description": "required" }, { "key": "button_url_ar", "value": "/ar/register", "type": "text", "description": "required" }, { "key": "image", "type": "file", "src": [], "description": "required (stored as section_background)" }, { "key": "features", "value": "[{\"feature_en\":\"Fast onboarding\",\"feature_ar\":\"تسجيل سريع\"}]", "type": "text", "description": "required, JSON array of {feature_en,feature_ar}" } ] } } }, { "name": "Get Customer Registration", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/cms/customer_registration/get.php", "host": [ "{{base_url}}" ], "path": [ "cms", "customer_registration", "get.php" ] }, "description": "Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first." } }, { "name": "Update Customer Registration", "request": { "method": "POST", "header": [], "url": { "raw": "{{base_url}}/cms/customer_registration/update.php", "host": [ "{{base_url}}" ], "path": [ "cms", "customer_registration", "update.php" ] }, "description": "All listed fields are required by this endpoint (not a partial update). Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "formdata", "formdata": [ { "key": "id", "value": "1", "type": "text", "description": "required" }, { "key": "title_en", "value": "Register Today", "type": "text", "description": "required" }, { "key": "title_ar", "value": "سجل اليوم", "type": "text", "description": "required" }, { "key": "description_en", "value": "Join now", "type": "text", "description": "required" }, { "key": "description_ar", "value": "انضم الآن", "type": "text", "description": "required" }, { "key": "icon", "type": "file", "src": [], "description": "required" }, { "key": "is_active", "value": "1", "type": "text", "description": "required" }, { "key": "button_text_en", "value": "Register", "type": "text", "description": "required" }, { "key": "button_text_ar", "value": "سجل", "type": "text", "description": "required" }, { "key": "button_url_en", "value": "/register", "type": "text", "description": "required" }, { "key": "button_url_ar", "value": "/ar/register", "type": "text", "description": "required" }, { "key": "image", "type": "file", "src": [], "description": "required" }, { "key": "features", "value": "[{\"feature_en\":\"Fast onboarding\",\"feature_ar\":\"تسجيل سريع\"}]", "type": "text", "description": "required, JSON array" } ] } } }, { "name": "Delete Customer Registration", "request": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/cms/customer_registration/delete.php", "host": [ "{{base_url}}" ], "path": [ "cms", "customer_registration", "delete.php" ] }, "description": "Soft delete. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "raw", "raw": "{\n \"id\": 1\n}", "options": { "raw": { "language": "json" } } } } } ], "description": "Privilege module: \"Customer Registration\"." }, { "name": "Footer", "item": [ { "name": "Section", "item": [ { "name": "Get Footer Section", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/cms/footer/section/get.php?section=general", "host": [ "{{base_url}}" ], "path": [ "cms", "footer", "section", "get.php" ], "query": [ { "key": "section", "value": "general", "description": "required, one of: general|payment_social|privacy_policy|return_policy|quotations_terms|faq", "disabled": false } ] }, "description": "Returns only the fields belonging to the requested section. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first." } }, { "name": "Update Footer Section", "request": { "method": "POST", "header": [], "url": { "raw": "{{base_url}}/cms/footer/section/update.php?section=general", "host": [ "{{base_url}}" ], "path": [ "cms", "footer", "section", "update.php" ], "query": [ { "key": "section", "value": "general", "description": "required, one of: general|payment_social|privacy_policy|return_policy|quotations_terms|faq", "disabled": false } ] }, "description": "Body shape depends on ?section=. Example below is for \"general\". For \"payment_social\": {\"payment_methods\":[\"gallery/icons/visa.svg\"],\"social_media\":[{\"icon\":\"gallery/icons/fb.svg\",\"link\":\"https://facebook.com/x\"}]} (icons can also be uploaded as files named payment_methods[] / social_media_icon_0, ...). For \"privacy_policy\"/\"return_policy\"/\"quotations_terms\"/\"faq\": {\"
_en\":\"...\",\"
_ar\":\"...\"}. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "formdata", "formdata": [ { "key": "background_image", "type": "file", "src": [], "description": "required for section=general" }, { "key": "email", "value": "info@masdar.com", "type": "text", "description": "required for section=general" }, { "key": "phone", "value": "+966500000000", "type": "text", "description": "required for section=general" }, { "key": "address", "value": "Riyadh, Saudi Arabia", "type": "text", "description": "required for section=general" }, { "key": "address_ar", "value": "الرياض، السعودية", "type": "text", "description": "required for section=general" }, { "key": "short_national_address_en", "value": "RXYZ1234", "type": "text", "description": "required for section=general" }, { "key": "short_national_address_ar", "value": "RXYZ1234", "type": "text", "description": "required for section=general" }, { "key": "short_national_address_url", "value": "https://short.national.address/RXYZ1234", "type": "text", "description": "required for section=general" } ] } } } ], "description": "Privilege module: \"Footer\". footer/get.php and footer/update.php (whole-footer endpoints) no longer exist - only per-section access remains." } ], "description": "" }, { "name": "Functions List", "item": [ { "name": "Get Functions List", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/cms/functions_list/get.php", "host": [ "{{base_url}}" ], "path": [ "cms", "functions_list", "get.php" ] }, "description": "Read-only reference list (id, fct_name) of every module that can be granted privileges via Admin Privileges / Admin Types. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first." } } ], "description": "Privilege module: \"Functions List\". Table functions_list." }, { "name": "Products Carousels", "item": [ { "name": "Create Product Carousel", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/cms/productsCarousels/create.php", "host": [ "{{base_url}}" ], "path": [ "cms", "productsCarousels", "create.php" ] }, "description": "Table cms_products_carousel. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "raw", "raw": "{\n \"carousel_name_en\": \"Best Sellers\",\n \"carousel_name_ar\": \"الأكثر مبيعا\",\n \"subtitle_en\": \"Top picks\",\n \"subtitle_ar\": \"أفضل الاختيارات\",\n \"view_all_url_en\": \"/en/best-sellers\",\n \"view_all_url_ar\": \"/ar/best-sellers\",\n \"start_date\": \"2026-08-01\",\n \"end_date\": \"2026-08-31\",\n \"product_ids\": [\n {\n \"code\": \"P001\",\n \"uom\": \"EA\"\n },\n {\n \"code\": \"P002\",\n \"uom\": \"BOX\"\n }\n ],\n \"position\": 1,\n \"is_active\": 1\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Get Product Carousels", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/cms/productsCarousels/get.php", "host": [ "{{base_url}}" ], "path": [ "cms", "productsCarousels", "get.php" ] }, "description": "Lists non-deleted carousels. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first." } }, { "name": "Update Product Carousel", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/cms/productsCarousels/update.php", "host": [ "{{base_url}}" ], "path": [ "cms", "productsCarousels", "update.php" ] }, "description": "All listed fields required (not partial). Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "raw", "raw": "{\n \"id\": 1,\n \"carousel_name_en\": \"Best Sellers\",\n \"carousel_name_ar\": \"الأكثر مبيعا\",\n \"subtitle_en\": \"Top picks\",\n \"subtitle_ar\": \"أفضل الاختيارات\",\n \"product_ids\": [\n {\n \"code\": \"P001\",\n \"uom\": \"EA\"\n }\n ],\n \"position\": 1,\n \"is_active\": 1\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Delete Product Carousel", "request": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/cms/productsCarousels/delete.php", "host": [ "{{base_url}}" ], "path": [ "cms", "productsCarousels", "delete.php" ] }, "description": "Soft delete (is_deleted=1). Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "raw", "raw": "{\n \"id\": 1\n}", "options": { "raw": { "language": "json" } } } } } ], "description": "Privilege module: \"Products Carousels\"." }, { "name": "Settings", "item": [ { "name": "Get Settings", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/cms/settings/get.php", "host": [ "{{base_url}}" ], "path": [ "cms", "settings", "get.php" ] }, "description": "site_maintenance / uat_maintenance / oms_maintenance / oms_uat_maintenance flags + chairman messages. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first." } }, { "name": "Update Settings", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/cms/settings/update.php", "host": [ "{{base_url}}" ], "path": [ "cms", "settings", "update.php" ] }, "description": "Partial update - provide any subset of these fields. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "raw", "raw": "{\n \"site_maintenance\": 0,\n \"uat_maintenance\": 0,\n \"oms_maintenance\": 0,\n \"oms_uat_maintenance\": 0,\n \"chairman_message_en\": \"Welcome to Masdar\",\n \"chairman_message_ar\": \"مرحبا بكم في مصدر\"\n}", "options": { "raw": { "language": "json" } } } } } ], "description": "Privilege module: \"Settings\"." }, { "name": "Security", "item": [ { "name": "Get Security Settings", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/cms/security/get.php", "host": [ "{{base_url}}" ], "path": [ "cms", "security", "get.php" ] }, "description": "JWT lifetime, login lockout thresholds, password minimum length, CMS lockdown flag, IP allowlist, idle timeout, and audit-log retention. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first." } }, { "name": "Update Security Settings", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/cms/security/update.php", "host": [ "{{base_url}}" ], "path": [ "cms", "security", "update.php" ] }, "description": "Partial update - provide any subset of these fields. Saving also lazily purges user_log rows older than log_retention_days. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "raw", "raw": "{\n \"jwt_lifetime_minutes\": 60,\n \"login_lockout_max_attempts\": 5,\n \"login_lockout_window_minutes\": 15,\n \"login_lockout_duration_minutes\": 15,\n \"password_min_length\": 8,\n \"cms_lockdown\": 0,\n \"ip_allowlist\": \"\",\n \"idle_timeout_minutes\": 30,\n \"log_retention_days\": 90\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Purge Audit Logs Now", "request": { "method": "POST", "header": [], "url": { "raw": "{{base_url}}/cms/security/purge_logs.php", "host": [ "{{base_url}}" ], "path": [ "cms", "security", "purge_logs.php" ] }, "description": "Immediately deletes user_log rows older than the configured log_retention_days. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first." } } ], "description": "Privilege module: \"Security\"." }, { "name": "Logs", "item": [ { "name": "Get Logs", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/cms/logs/get.php?page=1&limit=20&search=&admin_id=&module=&log_action=&status=&date_from=&date_to=", "host": [ "{{base_url}}" ], "path": [ "cms", "logs", "get.php" ], "query": [ { "key": "page", "value": "1", "description": "optional, default 1" }, { "key": "limit", "value": "20", "description": "optional, default 20, max 100" }, { "key": "search", "value": "", "description": "optional, matches description/email_attempted/endpoint/ip_address/admin username/fullname", "disabled": true }, { "key": "admin_id", "value": "", "description": "optional", "disabled": true }, { "key": "module", "value": "", "description": "optional, e.g. Settings, Security, Logs", "disabled": true }, { "key": "log_action", "value": "", "description": "optional, e.g. read, create, update, delete, login", "disabled": true }, { "key": "status", "value": "", "description": "optional, e.g. success, failed, error", "disabled": true }, { "key": "date_from", "value": "", "description": "optional, YYYY-MM-DD", "disabled": true }, { "key": "date_to", "value": "", "description": "optional, YYYY-MM-DD", "disabled": true } ] }, "description": "Paginated audit log list (table user_log), newest first. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first." } } ], "description": "Privilege module: \"Logs\"." }, { "name": "Why Masdar", "item": [ { "name": "Create Why Masdar Entry", "request": { "method": "POST", "header": [], "url": { "raw": "{{base_url}}/cms/why_masdar/create.php", "host": [ "{{base_url}}" ], "path": [ "cms", "why_masdar", "create.php" ] }, "description": "Table why_masdar. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "formdata", "formdata": [ { "key": "title_en", "value": "Quality", "type": "text", "description": "required" }, { "key": "title_ar", "value": "الجودة", "type": "text", "description": "required" }, { "key": "description_en", "value": "We deliver quality", "type": "text", "description": "required" }, { "key": "description_ar", "value": "نقدم الجودة", "type": "text", "description": "required" }, { "key": "icon", "type": "file", "src": [], "description": "required, SVG (sanitized server-side)" }, { "key": "is_active", "value": "1", "type": "text", "description": "required, 0 or 1" } ] } } }, { "name": "Get Why Masdar Entries", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/cms/why_masdar/get.php", "host": [ "{{base_url}}" ], "path": [ "cms", "why_masdar", "get.php" ] }, "description": "Lists non-deleted entries. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first." } }, { "name": "Update Why Masdar Entry", "request": { "method": "POST", "header": [], "url": { "raw": "{{base_url}}/cms/why_masdar/update.php", "host": [ "{{base_url}}" ], "path": [ "cms", "why_masdar", "update.php" ] }, "description": "All listed fields required (not partial). Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "formdata", "formdata": [ { "key": "id", "value": "1", "type": "text", "description": "required" }, { "key": "title_en", "value": "Quality", "type": "text", "description": "required" }, { "key": "title_ar", "value": "الجودة", "type": "text", "description": "required" }, { "key": "description_en", "value": "We deliver quality", "type": "text", "description": "required" }, { "key": "description_ar", "value": "نقدم الجودة", "type": "text", "description": "required" }, { "key": "icon", "type": "file", "src": [], "description": "required" }, { "key": "is_active", "value": "1", "type": "text", "description": "required" } ] } } }, { "name": "Delete Why Masdar Entry", "request": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/cms/why_masdar/delete.php", "host": [ "{{base_url}}" ], "path": [ "cms", "why_masdar", "delete.php" ] }, "description": "Soft delete. Requires Authorization: Bearer {{access_token}} (inherited from the CMS folder auth) — run Admin Login first.", "body": { "mode": "raw", "raw": "{\n \"id\": 1\n}", "options": { "raw": { "language": "json" } } } } } ], "description": "Privilege module: \"Why Masdar\"." } ], "description": "Back-office content management endpoints under /cms. Every endpoint except Admin Login requires a valid Bearer token (issued by Admin Login) AND the logged-in admin's user type must be granted the matching module/action privilege (see Admin Privileges) - otherwise the API returns 401 (bad/missing token) or a 200 with result:0 (authenticated but not permitted).", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{access_token}}", "type": "string" } ] } }, { "name": "Web (Public API)", "item": [ { "name": "Get Hero Banners", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/web/get-hero-banners.php", "host": [ "{{base_url}}" ], "path": [ "web", "get-hero-banners.php" ] }, "description": "Active, non-deleted cms_hero rows ordered by content_position. No authentication required (this project performs no Authorization header / token verification on this endpoint)." } }, { "name": "Get All Banners", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/web/get_all_banners.php", "host": [ "{{base_url}}" ], "path": [ "web", "get_all_banners.php" ] }, "description": "Returns hero_banners + static_banners + dynamic_banners (destination_page=0), all date/active filtered. No authentication required (this project performs no Authorization header / token verification on this endpoint)." } }, { "name": "Get All Blog Categories", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/web/get_all_blogs_categories.php?lang=en", "host": [ "{{base_url}}" ], "path": [ "web", "get_all_blogs_categories.php" ], "query": [ { "key": "lang", "value": "en", "description": "required, en or ar", "disabled": false } ] }, "description": "Nested parent/subcategory tree from blogsCategories. No authentication required (this project performs no Authorization header / token verification on this endpoint)." } }, { "name": "Get All Brands", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/web/get_all_brands.php", "host": [ "{{base_url}}" ], "path": [ "web", "get_all_brands.php" ] }, "description": "All cms_brand_items ordered by rank. No authentication required (this project performs no Authorization header / token verification on this endpoint)." } }, { "name": "Get Blog By Slug", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/web/get_blog_by_slug.php?lang=en&slug=my-first-blog-post", "host": [ "{{base_url}}" ], "path": [ "web", "get_blog_by_slug.php" ], "query": [ { "key": "lang", "value": "en", "description": "required, en or ar", "disabled": false }, { "key": "slug", "value": "my-first-blog-post", "description": "required, matches slug_en or slug_ar", "disabled": false } ] }, "description": "Increments view_count on every successful hit. No authentication required (this project performs no Authorization header / token verification on this endpoint)." } }, { "name": "Get Blogs By Category", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/web/get_blogs_by_category.php?lang=en&category_id=1", "host": [ "{{base_url}}" ], "path": [ "web", "get_blogs_by_category.php" ], "query": [ { "key": "lang", "value": "en", "description": "required, en or ar", "disabled": false }, { "key": "category_id", "value": "1", "description": "required", "disabled": false } ] }, "description": "Active, non-deleted articles for one category. No authentication required (this project performs no Authorization header / token verification on this endpoint)." } }, { "name": "Get Categories", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/web/get_categories.php?lang=en", "host": [ "{{base_url}}" ], "path": [ "web", "get_categories.php" ], "query": [ { "key": "lang", "value": "en", "description": "required, en or ar", "disabled": false } ] }, "description": "Active categories table (legacy \"categories\" table, not cms_categories). No authentication required (this project performs no Authorization header / token verification on this endpoint)." } }, { "name": "Get Customer Registration (Public)", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/web/get_customer_registration.php", "host": [ "{{base_url}}" ], "path": [ "web", "get_customer_registration.php" ] }, "description": "Active, non-deleted customer_registration section config. No authentication required (this project performs no Authorization header / token verification on this endpoint)." } }, { "name": "Get Footer Data", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/web/get_footer_data.php", "host": [ "{{base_url}}" ], "path": [ "web", "get_footer_data.php" ] }, "description": "Combines settings (maintenance flags, chairman message) + cms_footer in one payload. No authentication required (this project performs no Authorization header / token verification on this endpoint)." } }, { "name": "Get Header", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/web/get_header.php?lang=en", "host": [ "{{base_url}}" ], "path": [ "web", "get_header.php" ], "query": [ { "key": "lang", "value": "en", "description": "required, en or ar", "disabled": false } ] }, "description": "Active categories with nested subcategories, for site nav. No authentication required (this project performs no Authorization header / token verification on this endpoint)." } }, { "name": "Get Home Content", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/web/get_home_content.php", "host": [ "{{base_url}}" ], "path": [ "web", "get_home_content.php" ] }, "description": "Combines why_masdar + about_us + customer_registration + brands + home-screen blogs + promoted categories + product carousels. No authentication required (this project performs no Authorization header / token verification on this endpoint)." } }, { "name": "Get Last Published Blogs", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/web/get_last_published_blogs.php?lang=en", "host": [ "{{base_url}}" ], "path": [ "web", "get_last_published_blogs.php" ], "query": [ { "key": "lang", "value": "en", "description": "required, en or ar", "disabled": false } ] }, "description": "Last 2 published articles. No authentication required (this project performs no Authorization header / token verification on this endpoint)." } }, { "name": "Get Maintenance Status", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/web/get_maintenance_status.php", "host": [ "{{base_url}}" ], "path": [ "web", "get_maintenance_status.php" ] }, "description": "site_maintenance / uat_maintenance / oms_maintenance / oms_uat_maintenance flags. No authentication required (this project performs no Authorization header / token verification on this endpoint). Use this instead of the authenticated /cms/settings/get.php when checking maintenance status from a logged-out context (e.g. the CMS app-wide maintenance gate)." } }, { "name": "Get Parent Categories (Public)", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/web/get_parent_categories.php", "host": [ "{{base_url}}" ], "path": [ "web", "get_parent_categories.php" ], "query": [ { "key": "search", "value": "", "description": "optional", "disabled": true } ] }, "description": "Active, non-deleted, top-level cms_categories (includes is_promotional). No authentication required (this project performs no Authorization header / token verification on this endpoint)." } }, { "name": "Get Parent Subcategories (Public)", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/web/get_parent_subcategories.php?content_id=electronics", "host": [ "{{base_url}}" ], "path": [ "web", "get_parent_subcategories.php" ], "query": [ { "key": "content_id", "value": "electronics", "description": "required", "disabled": false } ] }, "description": "Non-deleted subcategories of content_id (data is a flat array; no longer includes bundled banner data or an is_active filter). No authentication required (this project performs no Authorization header / token verification on this endpoint)." } }, { "name": "Get Product Carousel (Public)", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/web/get_product_carousel.php", "host": [ "{{base_url}}" ], "path": [ "web", "get_product_carousel.php" ] }, "description": "Active, date-in-range cms_products_carousel rows, product_ids decoded to array. No authentication required (this project performs no Authorization header / token verification on this endpoint)." } }, { "name": "Get Promotions", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/web/get_promotions.php?lang=en", "host": [ "{{base_url}}" ], "path": [ "web", "get_promotions.php" ], "query": [ { "key": "lang", "value": "en", "description": "required, en or ar", "disabled": false } ] }, "description": "Active, non-deleted promotions table. No authentication required (this project performs no Authorization header / token verification on this endpoint)." } }, { "name": "Get Slideshows", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/web/get_slideshows.php?lang=en", "host": [ "{{base_url}}" ], "path": [ "web", "get_slideshows.php" ], "query": [ { "key": "lang", "value": "en", "description": "required, en or ar", "disabled": false } ] }, "description": "Active, non-deleted, desktop (is_mobile=0) slideshows table. No authentication required (this project performs no Authorization header / token verification on this endpoint)." } }, { "name": "Get Why Masdar (Public)", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/web/get_why_masdar.php", "host": [ "{{base_url}}" ], "path": [ "web", "get_why_masdar.php" ] }, "description": "Active, non-deleted why_masdar rows. No authentication required (this project performs no Authorization header / token verification on this endpoint)." } }, { "name": "Aramco", "item": [ { "name": "Cart", "item": [ { "name": "Add To Cart", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/web/aramco/cart/add.php", "host": [ "{{base_url}}" ], "path": [ "web", "aramco", "cart", "add.php" ] }, "description": "Upserts into user_carts - increments quantity if the (user_id,product_id,uom) row already exists. No authentication required (this project performs no Authorization header / token verification on this endpoint).", "body": { "mode": "raw", "raw": "{\n \"user_id\": 1001,\n \"product_id\": \"P001\",\n \"uom\": \"EA\",\n \"quantity\": 1\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Get Cart", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/web/aramco/cart/get.php?user_id=1001", "host": [ "{{base_url}}" ], "path": [ "web", "aramco", "cart", "get.php" ], "query": [ { "key": "user_id", "value": "1001", "description": "required", "disabled": false } ] }, "description": "No authentication required (this project performs no Authorization header / token verification on this endpoint)." } }, { "name": "Update Cart Item Quantity", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/web/aramco/cart/update.php", "host": [ "{{base_url}}" ], "path": [ "web", "aramco", "cart", "update.php" ] }, "description": "Sets absolute quantity (>=1) for an existing (user_id,product_id,uom) row. No authentication required (this project performs no Authorization header / token verification on this endpoint).", "body": { "mode": "raw", "raw": "{\n \"user_id\": 1001,\n \"product_id\": \"P001\",\n \"uom\": \"EA\",\n \"quantity\": 3\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Remove Cart Item", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/web/aramco/cart/remove.php", "host": [ "{{base_url}}" ], "path": [ "web", "aramco", "cart", "remove.php" ] }, "description": "Hard delete of one (user_id,product_id,uom) row. No authentication required (this project performs no Authorization header / token verification on this endpoint).", "body": { "mode": "raw", "raw": "{\n \"user_id\": 1001,\n \"product_id\": \"P001\",\n \"uom\": \"EA\"\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Clear Cart", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/web/aramco/cart/clear.php", "host": [ "{{base_url}}" ], "path": [ "web", "aramco", "cart", "clear.php" ] }, "description": "Hard deletes every row in user_carts for this user_id. No authentication required (this project performs no Authorization header / token verification on this endpoint).", "body": { "mode": "raw", "raw": "{\n \"user_id\": 1001\n}", "options": { "raw": { "language": "json" } } } } } ], "description": "Table user_carts. Note: web/aramco/login.php no longer exists - user_id is passed directly by the caller on every request." }, { "name": "Favorites", "item": [ { "name": "Add Favorite", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/web/aramco/favorites/add.php", "host": [ "{{base_url}}" ], "path": [ "web", "aramco", "favorites", "add.php" ] }, "description": "Table user_favorites. Rejects duplicate (user_id,product_id,uom). No authentication required (this project performs no Authorization header / token verification on this endpoint).", "body": { "mode": "raw", "raw": "{\n \"user_id\": 1001,\n \"product_id\": \"P001\",\n \"uom\": \"EA\"\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Get Favorites", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/web/aramco/favorites/get.php?user_id=1001", "host": [ "{{base_url}}" ], "path": [ "web", "aramco", "favorites", "get.php" ], "query": [ { "key": "user_id", "value": "1001", "description": "required", "disabled": false } ] }, "description": "No authentication required (this project performs no Authorization header / token verification on this endpoint)." } }, { "name": "Remove Favorite", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/web/aramco/favorites/remove.php", "host": [ "{{base_url}}" ], "path": [ "web", "aramco", "favorites", "remove.php" ] }, "description": "Hard delete of one (user_id,product_id,uom) row. No authentication required (this project performs no Authorization header / token verification on this endpoint).", "body": { "mode": "raw", "raw": "{\n \"user_id\": 1001,\n \"product_id\": \"P001\",\n \"uom\": \"EA\"\n}", "options": { "raw": { "language": "json" } } } } } ], "description": "Table user_favorites." } ], "description": "Aramco customer-portal sub-project under /web/aramco." } ], "description": "Public read endpoints directly under /web (no wrapper folder - these files sit at the web/ root in the codebase), plus the Aramco sub-project under /web/aramco. None of these endpoints authenticate the caller." }, { "name": "OMS (Operations)", "item": [ { "name": "Categories", "item": [ { "name": "Get Categories Tree", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/oms/categories/get_categories_tree.php", "host": [ "{{base_url}}" ], "path": [ "oms", "categories", "get_categories_tree.php" ], "query": [ { "key": "active_only", "value": "1", "description": "optional, default true; set to 0/false to include inactive", "disabled": true } ] }, "description": "Nested cms_categories tree keyed by parent_category/content_id. No authentication required (this project performs no Authorization header / token verification on this endpoint)." } }, { "name": "Get Parent Categories (OMS)", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/oms/categories/get_parent_categories.php", "host": [ "{{base_url}}" ], "path": [ "oms", "categories", "get_parent_categories.php" ], "query": [ { "key": "search", "value": "", "description": "optional", "disabled": true } ] }, "description": "Active, non-deleted, top-level cms_categories. No authentication required (this project performs no Authorization header / token verification on this endpoint)." } }, { "name": "Get Parent Subcategories (OMS)", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/oms/categories/get_parent_subcategories.php?content_id=electronics", "host": [ "{{base_url}}" ], "path": [ "oms", "categories", "get_parent_subcategories.php" ], "query": [ { "key": "content_id", "value": "electronics", "description": "required", "disabled": false } ] }, "description": "Non-deleted subcategories of content_id. No authentication required (this project performs no Authorization header / token verification on this endpoint)." } } ], "description": "" }, { "name": "Visits", "item": [ { "name": "Create Visit", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/oms/visits/create_visit.php", "host": [ "{{base_url}}" ], "path": [ "oms", "visits", "create_visit.php" ] }, "description": "Rejects if a visit already exists for the same client_id on the same calendar date. No authentication required (this project performs no Authorization header / token verification on this endpoint).", "body": { "mode": "raw", "raw": "{\n \"store_id\": 1,\n \"created_by\": 1,\n \"employee_id\": 1,\n \"client_id\": 1,\n \"visit_date\": \"2026-08-10\",\n \"visit_type\": \"sales call\"\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Check-in Visit", "request": { "method": "POST", "header": [], "url": { "raw": "{{base_url}}/oms/visits/checkin_visit.php?visit_id=1", "host": [ "{{base_url}}" ], "path": [ "oms", "visits", "checkin_visit.php" ], "query": [ { "key": "visit_id", "value": "1", "description": "required", "disabled": false } ] }, "description": "Transitions status pending -> in progress. No body fields required. No authentication required (this project performs no Authorization header / token verification on this endpoint)." } }, { "name": "Save Visit Draft", "request": { "method": "POST", "header": [], "url": { "raw": "{{base_url}}/oms/visits/draft_visit.php?visit_id=1", "host": [ "{{base_url}}" ], "path": [ "oms", "visits", "draft_visit.php" ], "query": [ { "key": "visit_id", "value": "1", "description": "required", "disabled": false } ] }, "description": "Only allowed when visit status is 'in progress' or 'draft'. Sets status to draft. No authentication required (this project performs no Authorization header / token verification on this endpoint).", "body": { "mode": "formdata", "formdata": [ { "key": "employee_id", "value": "1", "type": "text", "description": "required, must match visits.employee_id" }, { "key": "customer_name", "value": "Acme Corp", "type": "text", "description": "" }, { "key": "contact_person", "value": "Ahmed Ali", "type": "text", "description": "" }, { "key": "purpose", "value": "Follow up", "type": "text", "description": "" }, { "key": "discussion", "value": "Discussed pricing", "type": "text", "description": "" }, { "key": "outcomes", "value": "Positive", "type": "text", "description": "" }, { "key": "next_steps", "value": "Send quotation", "type": "text", "description": "" }, { "key": "notes", "value": "", "type": "text", "description": "" }, { "key": "attachments", "type": "file", "src": [], "description": "optional, multiple files: jpg/png/gif/webp/pdf/doc/docx/xls/xlsx/csv/ppt/pptx, max 25MB each" } ] } } }, { "name": "Complete Visit", "request": { "method": "POST", "header": [], "url": { "raw": "{{base_url}}/oms/visits/complete_visit.php?visit_id=1", "host": [ "{{base_url}}" ], "path": [ "oms", "visits", "complete_visit.php" ], "query": [ { "key": "visit_id", "value": "1", "description": "required", "disabled": false } ] }, "description": "Only allowed when visit status is 'in progress' or 'draft'. Sets status to completed. No authentication required (this project performs no Authorization header / token verification on this endpoint).", "body": { "mode": "formdata", "formdata": [ { "key": "employee_id", "value": "1", "type": "text", "description": "required, must match visits.employee_id" }, { "key": "customer_name", "value": "Acme Corp", "type": "text", "description": "required" }, { "key": "contact_person", "value": "Ahmed Ali", "type": "text", "description": "required" }, { "key": "purpose", "value": "Follow up", "type": "text", "description": "required" }, { "key": "discussion", "value": "Discussed pricing", "type": "text", "description": "required" }, { "key": "outcomes", "value": "Positive", "type": "text", "description": "required" }, { "key": "latitude", "value": "24.7136", "type": "text", "description": "required" }, { "key": "longitude", "value": "46.6753", "type": "text", "description": "required" }, { "key": "next_steps", "value": "Send quotation", "type": "text", "description": "" }, { "key": "notes", "value": "", "type": "text", "description": "" }, { "key": "follow_up_date", "value": "2026-09-01", "type": "text", "description": "optional, auto-creates a follow-up visit" }, { "key": "attachments", "type": "file", "src": [], "description": "optional, multiple files, same rules as draft_visit" } ] } } }, { "name": "New", "item": [ { "name": "Get Visits (Admin Calendar)", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/oms/visits/new/get_visits.php?from_date=2026-08-01&to_date=2026-08-31", "host": [ "{{base_url}}" ], "path": [ "oms", "visits", "new", "get_visits.php" ], "query": [ { "key": "from_date", "value": "2026-08-01", "description": "required, Y-m-d", "disabled": false }, { "key": "to_date", "value": "2026-08-31", "description": "required, Y-m-d", "disabled": false }, { "key": "store_id", "value": "1", "description": "optional filter", "disabled": true } ] }, "description": "Replaces the removed get_admin_visits.php / get_admin_single_day_visits.php. Day-by-day calendar grouped by employee for the given date range, admin-wide unless store_id is provided. No authentication required (this project performs no Authorization header / token verification on this endpoint)." } }, { "name": "Get ASM/Agent Visits", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/oms/visits/new/get_asm_agent_visits.php?from_date=2026-08-01&to_date=2026-08-31&store_id=1&employee_id=1", "host": [ "{{base_url}}" ], "path": [ "oms", "visits", "new", "get_asm_agent_visits.php" ], "query": [ { "key": "from_date", "value": "2026-08-01", "description": "required, Y-m-d", "disabled": false }, { "key": "to_date", "value": "2026-08-31", "description": "required, Y-m-d", "disabled": false }, { "key": "store_id", "value": "1", "description": "required", "disabled": false }, { "key": "employee_id", "value": "1", "description": "required", "disabled": false } ] }, "description": "Replaces the removed get_employee_all_visits.php / get_employee_single_day_visits.php. Same calendar response shape as Get Visits, scoped to one store_id + employee_id (ASM/agent). No authentication required (this project performs no Authorization header / token verification on this endpoint)." } }, { "name": "Get Store Manager Visits", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/oms/visits/new/get_store_manager_visits.php?from_date=2026-08-01&to_date=2026-08-31&store_id=1", "host": [ "{{base_url}}" ], "path": [ "oms", "visits", "new", "get_store_manager_visits.php" ], "query": [ { "key": "from_date", "value": "2026-08-01", "description": "required, Y-m-d", "disabled": false }, { "key": "to_date", "value": "2026-08-31", "description": "required, Y-m-d", "disabled": false }, { "key": "store_id", "value": "1", "description": "required", "disabled": false } ] }, "description": "Replaces the removed get_store_manager_all_visits.php / get_store_manager_single_day_visits.php. Calendar view for all employees at one store over the given date range. No authentication required (this project performs no Authorization header / token verification on this endpoint)." } }, { "name": "Get User Assigned Visits (Single Day)", "request": { "method": "GET", "header": [], "url": { "raw": "{{base_url}}/oms/visits/new/get_user_assigned_visits.php?store_id=1&employee_id=1&date=2026-08-15", "host": [ "{{base_url}}" ], "path": [ "oms", "visits", "new", "get_user_assigned_visits.php" ], "query": [ { "key": "store_id", "value": "1", "description": "required", "disabled": false }, { "key": "employee_id", "value": "1", "description": "required", "disabled": false }, { "key": "date", "value": "2026-08-15", "description": "required, Y-m-d", "disabled": false } ] }, "description": "New endpoint. Flat (non-calendar) list of one employee's visits at one store on a single date. No authentication required (this project performs no Authorization header / token verification on this endpoint)." } }, { "name": "Edit Visit", "request": { "method": "PUT", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/oms/visits/new/edit_visit.php", "host": [ "{{base_url}}" ], "path": [ "oms", "visits", "new", "edit_visit.php" ] }, "description": "New endpoint. Only allowed while visit status is 'pending' (or blank). Rejects if another visit already exists for the same client_id on the same calendar date. No authentication required (this project performs no Authorization header / token verification on this endpoint).", "body": { "mode": "raw", "raw": "{\n \"id\": 1,\n \"store_id\": 1,\n \"employee_id\": 1,\n \"employee_name\": \"Ahmed Ali\",\n \"client_id\": 1,\n \"visit_date\": \"2026-08-20\",\n \"visit_type\": \"sales call\"\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Delete Visit", "request": { "method": "DELETE", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/oms/visits/new/delete_visit.php", "host": [ "{{base_url}}" ], "path": [ "oms", "visits", "new", "delete_visit.php" ] }, "description": "New endpoint. Hard delete - only allowed while visit status is 'pending'. No authentication required (this project performs no Authorization header / token verification on this endpoint).", "body": { "mode": "raw", "raw": "{\n \"id\": 1\n}", "options": { "raw": { "language": "json" } } } } } ], "description": "Endpoints under oms/visits/new/ - replacement calendar-style visit queries plus edit/delete, added when get_admin_visits.php and friends were removed." } ], "description": "" } ], "description": "Operations Management endpoints under /oms - visit tracking for field employees, store managers, and admins. All unauthenticated at the HTTP layer; employee_id is validated only against DB state (or not at all), never against a token." } ] }