Login

User login using email/password or phone/OTP.

Request

Method: POST
URL: /api/auth/login
Content-Type: application/json

Request Body:

Note: Either email + password or phone + otp must be sent.

Example Request

curl -X POST "https://example.com/api/auth/login" \
  -H "Content-Type: application/json" \
  -d '{"email": "admin@example.com", "password": "secret"}'

Success Response (200)

{
  "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
  "user": {
    "id": 1,
    "first_name": "Admin",
    "last_name": "System",
    "email": "admin@example.com",
    "user_type": "staff",
    "is_admin": 1,
    "status": "active"
  }
}

Errors

Send OTP

Send a one-time password (OTP) to the user's phone number.

Request

Method: POST
URL: /api/auth/send-otp
Content-Type: application/json

Request Body:

Example Request

curl -X POST "https://example.com/api/auth/send-otp" \
  -H "Content-Type: application/json" \
  -d '{"phone": "09123456789"}'

Success Response (200)

{
  "success": true,
  "message": "One-time password sent successfully"
}

Errors

Current User Information

Get information about the currently authenticated user.

Request

Method: GET
URL: /api/auth/me
Headers: Authorization: Bearer {token}

Example Request

curl -X GET "https://example.com/api/auth/me" \
  -H "Authorization: Bearer {token}"

Success Response (200)

{
  "id": 1,
  "first_name": "Admin",
  "last_name": "System",
  "email": "admin@example.com",
  "user_type": "staff",
  "is_admin": 1,
  "role_id": 0,
  "status": "active",
  "job_title": "System Admin",
  "phone": "09123456789",
  "image": null,
  "language": "persian",
  "created_at": "1403-01-01"
}

Errors

Logout

Logout the user and invalidate the current token.

Request

Method: POST
URL: /api/auth/logout
Headers: Authorization: Bearer {token}

Example Request

curl -X POST "https://example.com/api/auth/logout" \
  -H "Authorization: Bearer {token}"

Success Response (200)

{
  "success": true,
  "message": "Logged out successfully"
}

Errors

Request Password Reset

Send a password reset email to the user.

Request

Method: POST
URL: /api/auth/request-reset-password
Content-Type: application/json

Request Body:

Example Request

curl -X POST "https://example.com/api/auth/request-reset-password" \
  -H "Content-Type: application/json" \
  -d '{"email": "user@example.com"}'

Success Response (200)

{
  "success": true,
  "message": "Password reset email sent"
}

Errors

Change Password with Recovery Code

Change password using the code received from the recovery email.

Request

Method: POST
URL: /api/auth/change-password
Content-Type: application/json

Request Body:

Example Request

curl -X POST "https://example.com/api/auth/change-password" \
  -H "Content-Type: application/json" \
  -d '{"code": "123456", "password": "new-password", "retype_password": "new-password"}'

Success Response (200)

{
  "success": true,
  "message": "Password changed successfully"
}

Errors

Phone Number Change

Change the authenticated user's phone number in two steps.

Step 1: Send OTP to New Number

Method: POST
URL: /api/auth/phone/change/send-otp
Headers: Authorization: Bearer {token} Content-Type: application/json

Request Body:

curl -X POST "https://example.com/api/auth/phone/change/send-otp" \
  -H "Authorization: Bearer {token}" \
  -H "Content-Type: application/json" \
  -d '{"phone": "09123456789"}'

Step 2: Verify OTP

Method: POST
URL: /api/auth/phone/change/verify-otp
Headers: Authorization: Bearer {token} Rate Limit: 100:1

Request Body:

curl -X POST "https://example.com/api/auth/phone/change/verify-otp" \
  -H "Authorization: Bearer {token}" \
  -H "Content-Type: application/json" \
  -d '{"phone": "09123456789", "otp": "123456"}'

Success Response (200)

{
  "success": true,
  "message": "Phone number changed successfully"
}

Errors