Overview

This page is the developer reference for the DayOneMart REST API — the single integration surface shared by the Customer App, the Deliveryman App, and the Vue-based Admin Panel. Every endpoint listed below is registered in the Laravel route files that ship with the product, so you can verify each one directly in the source:

Base URL:   https://yourdomain.com/api/v1
Format:     JSON (request and response)
Auth:       Bearer JWT — Authorization: Bearer {token}

Authentication (JWT)

The API uses JWT bearer tokens issued by tymon/jwt-auth. Each audience (customer, deliveryman, admin) obtains a token from its own login endpoint and sends it on every protected request.

1. Log in to obtain a token

POST /api/v1/customer/auth/login
Content-Type: application/json

{
  "email": "customer@example.com",
  "password": "secret123"
}

2. Response

{
  "success": true,
  "message": "Login successful",
  "data": {
    "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
    "token_type": "bearer",
    "expires_in": 3600,
    "user": { "id": 12, "name": "Jane Doe", "email": "customer@example.com" }
  }
}

3. Call protected endpoints with the token

GET /api/v1/customer/orders
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...

4. Refresh before expiry, log out to invalidate

POST /api/v1/customer/auth/refresh    Authorization: Bearer {current_token}
POST /api/v1/customer/auth/logout     Authorization: Bearer {current_token}

Request Headers

Response Format

Every endpoint returns the same JSON envelope, so clients can parse responses uniformly:

// Success
{ "success": true,  "message": "...", "data": { ... } }

// Paginated list
{ "success": true, "data": [ ... ],
  "meta": { "current_page": 1, "last_page": 5, "per_page": 20, "total": 92 } }

// Validation / error
{ "success": false, "message": "The given data was invalid.",
  "errors": { "email": ["The email field is required."] } }

HTTP Status Codes

Customer API — /api/v1/customer

Consumed by the Flutter Customer App and the web storefront. The Flutter app declares each of these paths as a constant in lib/config/util/app_constants.dart.

Authentication

Catalog — Items, Categories, Brands, Offers (Public)

Catalog routes are public (no JWT required) but honor two identifying middlewares: user.id ties guest activity (cart, recently viewed) to a device-generated guest ID, and hub.context scopes results to the delivery hub resolved from the customer's location.

Cart, Coupons & Checkout

Cart and checkout work for both logged-in customers and guests (via the user.id guest identifier), so a cart survives login.

Account — Orders, Profile, Wallet & More (Protected)

App Screen, Content & Maps Proxy

These endpoints power the app shell: startup configuration, the home screen payload, CMS content pages, and a server-side Google Maps proxy so the Maps Platform key never has to be embedded for geocoding/directions calls.

Deliveryman API — /api/v1/delivery-man

Consumed by the Flutter Deliveryman App.

Authentication

Work & Account

Config & Maps Proxy

Admin API — /api/v1/admin

Consumed by the Vue 3 Admin Panel. Every route (except login) requires a JWT issued to an admin or employee account; many are additionally guarded by RBAC permissions (shown as JWT + RBAC) so employee roles only reach what they are granted.

Authentication & Dashboard

Order Management

Catalog Management (Standard REST Resources)

Each resource below follows the Laravel apiResource convention — GET / (list), POST / (create), GET /{id} (show), PUT /{id} (update), DELETE /{id} (delete) — plus the listed extras:

User Management

Settings & Integrations

Communication

Payment Gateway Endpoints — /payment-gateway

Online payments run through hosted gateway pages. When a customer chooses digital payment, the client opens /payment-gateway/{gateway}/checkout (the mobile apps open it in an in-app webview), the customer pays on the gateway's page, and the gateway redirects back to the success / cancel / callback URL, where the order's payment status is updated. These routes live at the web root (not under /api/v1) and are CSRF-exempt so gateway redirects always land.

Integration Points (Third-Party Services)

The platform integrates with external services at well-defined points. All credentials are entered in the Admin Panel → Settings after installation — the table shows where each integration plugs into the codebase.

Postman Collection

A complete Postman collection ships in the Admin & Web package root as postman-collection.json (~485 KB) with the full request/response schema — bodies, parameters, and example responses — for every endpoint on this page.

1. Import the collection In Postman: File → Import and select postman-collection.json from the Admin and Web Install folder. (Insomnia and Bruno can import the same file.)
2. Set the base URL variable Point the collection's base_url variable at your installation, e.g. https://yourdomain.com.
3. Authenticate once Run the login request for the audience you are testing (customer, deliveryman, or admin) and copy the returned token into the collection's bearer-token auth so every subsequent request is authorized.

Extending the API

To add your own endpoints, follow the layered pattern used across the codebase — thin controller, Form Request validation, business logic in a service, API Resource for the response envelope, and a route registered in routes/api/v1/. The Extending the Platform section of the Admin & Web docs walks through this end-to-end with commands and code samples.

Need help? Reach us via the item’s Support tab on CodeCanyon or dayonesoft.com or visit our website for support.