API Endpoints - Finanzapp

Overview

This page documents all available API endpoints in Finanzapp. All endpoints require the X-Requested-With: XMLHttpRequest header and return JSON responses.

Base URL: https://pro.finanzapp.es (Production) or http://localhost/FinanzApp (Development)

Authentication Endpoints

Authenticate a user with email and password.

curl -X POST https://pro.finanzapp.es/app/auth/sendLogin.php \
  -H "X-Requested-With: XMLHttpRequest" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "email=user@example.com" \
  -d "password=SecurePass123"

const formData = new FormData();
formData.append('email', 'user@example.com');
formData.append('password', 'SecurePass123');

fetch('https://pro.finanzapp.es/app/auth/sendLogin.php', {
  method: 'POST',
  headers: { 'X-Requested-With': 'XMLHttpRequest' },
  body: formData
})
.then(res => res.json())
.then(data => console.log(data));

import requests

url = "https://pro.finanzapp.es/app/auth/sendLogin.php"
headers = {"X-Requested-With": "XMLHttpRequest"}
data = {
    "email": "user@example.com",
    "password": "SecurePass123"
}

response = requests.post(url, headers=headers, data=data)
print(response.json())

Endpoint: POST /app/auth/sendLogin.php

Request Parameters

string

required

User’s email address

string

required

User’s password (min 8 chars, 1 uppercase, 1 number)

string

reCAPTCHA token for bot protection

Response

boolean

required

Whether the login was successful

string

Human-readable status message

object

User information (only on success)

Show properties

integer

Unique user ID

string

User’s email

string

User’s full name

string

Avatar URL

integer

Newsletter preference (0 or 1)

Response Examples

200 - Success

{
  "success": true,
  "message": "Login successful",
  "user": {
    "id": 123,
    "email": "user@example.com",
    "name": "John Doe",
    "url_image": "https://carefully-happy-quetzal.global.ssl.fastly.net/assets/avatars/01.jpeg",
    "accept_news": 1
  }
}

200 - Invalid Credentials

{
  "success": false,
  "message": "Email o contraseña incorrectas"
}

403 - Forbidden

{
  "success": false,
  "message": "Acceso prohibido"
}

Register

Create a new user account.

curl -X POST https://pro.finanzapp.es/app/auth/sendRegister.php \
  -H "X-Requested-With: XMLHttpRequest" \
  -d "nombre=John Doe" \
  -d "email=john@example.com" \
  -d "password=SecurePass123" \
  -d "confirm-password=SecurePass123" \
  -d "terms=on" \
  -d "notifications=on"

const formData = new FormData();
formData.append('nombre', 'John Doe');
formData.append('email', 'john@example.com');
formData.append('password', 'SecurePass123');
formData.append('confirm-password', 'SecurePass123');
formData.append('terms', 'on');
formData.append('notifications', 'on');

fetch('https://pro.finanzapp.es/app/auth/sendRegister.php', {
  method: 'POST',
  headers: { 'X-Requested-With': 'XMLHttpRequest' },
  body: formData
})
.then(res => res.json())
.then(data => console.log(data));

Endpoint: POST /app/auth/sendRegister.php

Request Parameters

string

required

User’s full name

string

required

User’s email address (must be unique)

string

required

User’s password (min 8 chars, 1 uppercase, 1 number)

string

required

Password confirmation (must match password)

string

required

Terms acceptance (must be “on”)

string

Newsletter subscription (“on” or omit)

Response

boolean

required

Registration success status

string

required

Status message

Response Examples

200 - Success

{
  "success": true,
  "message": "Usuario registrado correctamente"
}

200 - Email Exists

{
  "success": false,
  "message": "El email ya está registrado"
}

Authenticate using Google OAuth credentials.

fetch('https://pro.finanzapp.es/app/auth/google-callback-login.php', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    credential: 'eyJhbGciOiJSUzI1NiIsImtpZCI6IjE4MmU0M...' // Google JWT
  })
})
.then(res => res.json())
.then(data => console.log(data));

Endpoint: POST /app/auth/google-callback-login.php

Request Parameters

string

required

Google JWT credential token

Response

string

required

"exists" if user exists, "inserted" if new user created

object

User profile data from Google

Response Examples

Existing User

{
  "status": "exists",
  "user": {
    "id": 456,
    "email": "john.doe@gmail.com",
    "name": "John Doe"
  }
}

New User

{
  "status": "inserted",
  "user": {
    "id": 789,
    "email": "jane.smith@gmail.com",
    "name": "Jane Smith"
  }
}

Logout

End the current user session.

curl -X POST https://pro.finanzapp.es/app/auth/logout.php \
  -H "X-Requested-With: XMLHttpRequest"

fetch('https://pro.finanzapp.es/app/auth/logout.php', {
  method: 'POST',
  headers: { 'X-Requested-With': 'XMLHttpRequest' }
})
.then(res => res.json())
.then(data => console.log(data));

Endpoint: POST /app/auth/logout.php Source: /home/daytona/workspace/source/app/auth/logout.php

Request Parameters

No parameters required.

Response

boolean

required

Logout success status

string

required

Status message

Response Examples

200 - Success

{
  "success": true,
  "message": "Sesión cerrada correctamente"
}

403 - Invalid Request

{
  "success": false,
  "message": "Acceso prohibido"
}

405 - Method Not Allowed

{
  "success": false,
  "message": "Método no permitido"
}

User Management

Update User Configuration

Update user profile settings including name, password, avatar, and notification preferences.

const formData = new FormData();
formData.append('name', 'John Updated');
formData.append('avatar', 'https://carefully-happy-quetzal.global.ssl.fastly.net/assets/avatars/02.jpeg');
formData.append('password', 'NewSecurePass123'); // Optional
formData.append('confirm_password', 'NewSecurePass123'); // If password provided
formData.append('notifications', 'on'); // Optional

fetch('https://pro.finanzapp.es/app/auth/sendUserConfig.php', {
  method: 'POST',
  headers: { 'X-Requested-With': 'XMLHttpRequest' },
  body: formData
})
.then(res => res.json())
.then(data => {
  if (data.success) {
    console.log('Settings updated successfully');
    window.location.reload();
  }
});

Endpoint: POST /app/auth/sendUserConfig.php Authentication Required: Yes (active session)

Request Parameters

string

required

User’s full name

string

URL of selected avatar image (from predefined options)

string

New password (optional, only if changing password)

string

Password confirmation (required if password provided)

string

Newsletter preference (“on” or omit)

Available Avatars

Finanzapp provides 10 predefined avatar options plus a default:

https://carefully-happy-quetzal.global.ssl.fastly.net/assets/avatars/01.jpeg
https://carefully-happy-quetzal.global.ssl.fastly.net/assets/avatars/02.jpeg
...
https://carefully-happy-quetzal.global.ssl.fastly.net/assets/avatars/10.jpeg
https://carefully-happy-quetzal.global.ssl.fastly.net/assets/avatars/default.jpeg

Response

boolean

required

Update success status

string

Status message

Response Examples

200 - Success

{
  "success": true,
  "message": "Configuración actualizada correctamente"
}

200 - Validation Error

{
  "success": false,
  "message": "Las contraseñas no coinciden"
}

Delete Account

Permanently delete the user’s account and all associated data.

fetch('https://pro.finanzapp.es/app/auth/deleteAccount.php', {
  method: 'POST',
  headers: { 'X-Requested-With': 'XMLHttpRequest' }
})
.then(res => res.json())
.then(data => {
  if (data.success) {
    console.log('Account deleted');
    window.location.href = '/index.php';
  }
});

Endpoint: POST /app/auth/deleteAccount.php Source: /home/daytona/workspace/source/app/auth/deleteAccount.php Authentication Required: Yes (active session with email)

This action is irreversible. All user data will be permanently deleted from the database.

Request Parameters

No parameters required. Uses the email from the current session.

Implementation Details

The endpoint (source: /home/daytona/workspace/source/app/auth/deleteAccount.php:21-24):

$sql = "DELETE FROM users WHERE email LIKE ?";
$stmt = $conn->prepare($sql);
$stmt->bind_param("s", $email);
$stmt->execute();

Response

boolean

required

Deletion success status

string

required

Status message

Response Examples

200 - Success

{
  "success": true,
  "message": "Usuario eliminado correctamente."
}

200 - No Active Session

{
  "success": false,
  "message": "No hay una sesión activa con email."
}

403 - Invalid Request

{
  "success": false,
  "message": "Acceso prohibido"
}

Password Reset

Request Password Reset

Send a password reset email to the user.

const formData = new FormData();
formData.append('email', 'user@example.com');

fetch('https://pro.finanzapp.es/app/auth/sendResetLink.php', {
  method: 'POST',
  headers: { 'X-Requested-With': 'XMLHttpRequest' },
  body: formData
})
.then(res => res.json())
.then(data => {
  if (data.success) {
    console.log('Reset email sent');
  }
});

Endpoint: POST /app/auth/sendResetLink.php

Request Parameters

string

required

Email address of the account to reset

Response

boolean

required

Email sent status

string

required

Status message

Response Examples

200 - Success

{
  "success": true,
  "message": "Correo de restablecimiento enviado"
}

200 - Email Not Found

{
  "success": false,
  "message": "No existe una cuenta con ese email"
}

Reset Password

Set a new password using a reset token.

const formData = new FormData();
formData.append('token', 'abc123def456...');
formData.append('new_password', 'NewSecurePass123');
formData.append('confirm_password', 'NewSecurePass123');

fetch('https://pro.finanzapp.es/app/auth/resetPassword.php', {
  method: 'POST',
  headers: { 'X-Requested-With': 'XMLHttpRequest' },
  body: formData
})
.then(res => res.json())
.then(data => console.log(data));

Endpoint: POST /app/auth/resetPassword.php

Request Parameters

string

required

Password reset token from email link

string

required

New password (min 8 chars, 1 uppercase, 1 number)

string

required

Password confirmation (must match new_password)

Response

boolean

required

Password reset status

string

required

Status message

Response Examples

200 - Success

{
  "success": true,
  "message": "Contraseña restablecida con éxito"
}

200 - Invalid Token

{
  "success": false,
  "message": "Token inválido o expirado"
}

200 - Password Mismatch

{
  "success": false,
  "message": "Las contraseñas no coinciden"
}

Data Management

Receive Data

Generic endpoint for receiving and storing JSON data.

const data = {
  userId: 123,
  action: 'update_preference',
  preferences: {
    theme: 'dark',
    notifications: true
  }
};

fetch('https://pro.finanzapp.es/receive-data.php', {
  method: 'POST',
  headers: {
    'X-Requested-With': 'XMLHttpRequest',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify(data)
})
.then(res => res.json())
.then(result => console.log(result));

const records = [
  { id: 1, type: 'expense', amount: 50.00 },
  { id: 2, type: 'income', amount: 1000.00 },
  { id: 3, type: 'expense', amount: 25.50 }
];

fetch('https://pro.finanzapp.es/receive-data.php', {
  method: 'POST',
  headers: {
    'X-Requested-With': 'XMLHttpRequest',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify(records)
})
.then(res => res.json())
.then(result => console.log(result));

Endpoint: POST /receive-data.php Source: /home/daytona/workspace/source/receive-data.php

Request Parameters

object | array

required

JSON data to store. Can be a single object or array of objects.

Implementation Details

The endpoint writes received JSON data to a file (data.txt) for logging/storage:

$inputJSON = file_get_contents('php://input');
$data = json_decode($inputJSON, true);

if (json_last_error() === JSON_ERROR_NONE) {
    $file = fopen('data.txt', 'a');
    
    if (is_array($data)) {
        foreach ($data as $entry) {
            fwrite($file, json_encode($entry, JSON_UNESCAPED_UNICODE) . PHP_EOL);
        }
    } else {
        fwrite($file, json_encode($data, JSON_UNESCAPED_UNICODE) . PHP_EOL);
    }
    
    fclose($file);
}

Response

boolean

required

Data save status

string

required

Status message

Response Examples

200 - Success

{
  "success": true,
  "message": "Data saved successfully"
}

200 - Invalid JSON

{
  "success": false,
  "message": "Invalid JSON"
}

403 - Access Denied

{
  "success": false,
  "message": "Access denied"
}

Error Responses

All endpoints follow a consistent error response format:

Common Error Codes

Missing or invalid X-Requested-With header

{
  "success": false,
  "message": "Acceso prohibido"
}

Invalid HTTP method used

{
  "success": false,
  "message": "Método no permitido"
}

No active session or session expired

{
  "success": false,
  "message": "No hay una sesión activa"
}

Invalid or missing required parameters

{
  "success": false,
  "message": "Parámetros inválidos"
}

Validation Errors

Error Message	Cause
`El campo email es obligatorio`	Email field is empty
`Introduce un email válido`	Email format is invalid
`La contraseña debe tener al menos 8 caracteres, una mayúscula y un número`	Password doesn’t meet requirements
`Las contraseñas no coinciden`	Password and confirmation don’t match
`Debe aceptar los términos y condiciones`	Terms checkbox not checked
`El email ya está registrado`	Email already exists in database
`Token inválido o expirado`	Password reset token is invalid

Rate Limiting

Currently, there is no explicit rate limiting implemented in the API. For production deployments, consider adding:

Request throttling per IP address
Login attempt limiting (prevent brute force)
CAPTCHA verification on repeated failures
API key management for programmatic access

Testing the API

You can test the API endpoints using various tools:

Using Postman

Create a new request
Set method to POST
Add header: X-Requested-With: XMLHttpRequest
For form data: Select “Body” > “form-data” and add parameters
For JSON: Select “Body” > “raw” > “JSON” and paste JSON data

Using Browser Console

// Test login endpoint
const testLogin = async () => {
  const formData = new FormData();
  formData.append('email', 'test@example.com');
  formData.append('password', 'TestPass123');
  
  const response = await fetch('https://pro.finanzapp.es/app/auth/sendLogin.php', {
    method: 'POST',
    headers: { 'X-Requested-With': 'XMLHttpRequest' },
    body: formData
  });
  
  const data = await response.json();
  console.log(data);
};

testLogin();

Best Practices

Always include X-Requested-With header

All API endpoints validate this header to prevent direct browser access and CSRF attacks.

headers: {
  'X-Requested-With': 'XMLHttpRequest'
}

Handle session expiration gracefully

Check for authentication errors and redirect users to login when sessions expire.

if (!data.success && data.message.includes('sesión')) {
  window.location.href = '/app/login.php';
}

Validate data client-side before submission

Implement client-side validation to provide immediate feedback and reduce server load.

if (!validateEmail(email)) {
  showError('Please enter a valid email');
  return;
}

Use HTTPS in production

Always use HTTPS to encrypt sensitive data like passwords during transmission.

Implement proper error handling

Always handle errors gracefully and provide meaningful feedback to users.

try {
  const response = await fetch(url, options);
  const data = await response.json();
  if (data.success) {
    // Handle success
  } else {
    // Handle application error
  }
} catch (error) {
  // Handle network error
  console.error('Network error:', error);
}

​Overview

​Authentication Endpoints

​Login

​Request Parameters

​Response

​Response Examples

​Register

​Request Parameters

​Response

​Response Examples

​Google Login

​Request Parameters

​Response

​Response Examples

​Logout

​Request Parameters

​Response

​Response Examples

​User Management

​Update User Configuration

​Request Parameters

​Available Avatars

​Response

​Response Examples

​Delete Account

​Request Parameters

​Implementation Details

​Response

​Response Examples

​Password Reset

​Request Password Reset

​Request Parameters

​Response

​Response Examples

​Reset Password

​Request Parameters

​Response

​Response Examples

​Data Management

​Receive Data

​Request Parameters

​Implementation Details

​Response

​Response Examples

​Error Responses

​Common Error Codes

​Validation Errors

​Rate Limiting

​Testing the API

​Using Postman

​Using Browser Console

​Best Practices

​Need Help?

API Overview

Authentication

Overview

Authentication Endpoints

Login

Request Parameters

Response

Response Examples

Register

Request Parameters

Response

Response Examples

Google Login

Request Parameters

Response

Response Examples

Logout

Request Parameters

Response

Response Examples

User Management

Update User Configuration

Request Parameters

Available Avatars

Response

Response Examples

Delete Account

Request Parameters

Implementation Details

Response

Response Examples

Password Reset

Request Password Reset

Request Parameters

Response

Response Examples

Reset Password

Request Parameters

Response

Response Examples

Data Management

Receive Data

Request Parameters

Implementation Details

Response

Response Examples

Error Responses

Common Error Codes

Validation Errors

Rate Limiting

Testing the API

Using Postman

Using Browser Console

Best Practices

Need Help?