MELIKA admin role: platform-wide statistics, user and doctor management, bulk schedule generation, and specialty and medication catalogue administration.
Use this file to discover all available pages before exploring further.
The administrator role is MELIKA’s highest-privilege role. Every request to an admin route is validated by both the verifyToken and isAdmin middleware guards, meaning a valid JWT and a rol: "admin" claim are required. From the /admin panel, administrators oversee the entire platform: they monitor real-time statistics, manage user accounts and doctor profiles, configure availability schedules in bulk, and maintain the catalogues of specialties and medications.
Admin JWT tokens grant unrestricted access to every management endpoint on the platform, including the ability to deactivate users and modify medical records catalogues. Store admin tokens securely and never expose them in client-side code or public repositories. A compromised admin token gives an attacker full platform access until it expires (8 hours) or the account is deactivated.
Toggles the activo flag on the target user account. A deactivated user cannot log in and their JWT is effectively unusable even before it expires.
MELIKA prevents administrators from deactivating other admin accounts through this endpoint. Any attempt to toggle an admin account’s status returns a 400 error, protecting platform governance continuity.
Creating a doctor simultaneously builds their usuarios record and sends an invitation email with a 72-hour activation token:
POST /medicosAuthorization: Bearer <admin-token>Content-Type: application/json
{ "nombre": "Ana", "primer_apellido": "Ramírez", "email": "ana.ramirez@hospital.co", "tipo_documento": "CC", "numero_documento": "1023456789", "id_especialidad": 2, "numero_registro": "RM-20483", "acepta_teleconsulta": true, "acepta_presencial": true, "biografia": "Cardiologist with 12 years of experience.", "anos_experiencia": 12}
The fields nombre, primer_apellido, email, tipo_documento, numero_documento, numero_registro, and id_especialidad are required. The tipo_documento value must be CC, CE, or PASAPORTE. The initial consultation fee is set to 0 and can be updated later via PUT /medicos/:id. The doctor receives an email with a link to set their password and activate the account.
PUT /medicos/:idAuthorization: Bearer <admin-token>Content-Type: application/json
Accepts any subset of the doctor’s profile fields. Useful for correcting registration numbers, updating fees (tarifa), or changing the linked specialty.
Activates or deactivates a doctor account. Toggling a doctor also updates the activo flag on their linked usuarios record. Deactivated doctors do not appear in patient-facing specialty and booking flows.
MELIKA calculates consecutive 40-minute windows from hora_inicio to hora_fin, skipping any window that overlaps the inicio_descanso–fin_descanso range. Duplicate slots (same doctor, date, and hora_inicio) are silently skipped and counted under duplicadas.
Field
Required
Description
id_medico
✅
Target doctor (must be active)
fecha
✅
Date for the generated slots
hora_inicio
✅
Start of working day
hora_fin
✅
End of working day; must be after hora_inicio
inicio_descanso
❌
Break start (must be after hora_inicio)
fin_descanso
❌
Break end (must be before hora_fin); required when inicio_descanso is supplied
Neither action is permitted on a slot that has an active appointment (disponible = false). Attempting either returns a 400 error. A time overlap with another existing slot for the same doctor and date returns a 409 Conflict error.
GET /admin/horarios?inicio=2025-08-01&fin=2025-08-31&id_medico=3Authorization: Bearer <admin-token>
Returns FullCalendar-compatible event objects for all slots in the date range, optionally filtered to a specific doctor. Each event includes extendedProps with disponible, id_medico, medico_nombre, especialidad, cita_id, cita_estado, and paciente fields.
{ "estado": "cancelada", "razon_cancelacion": "Doctor unavailable due to medical emergency"}
Valid values for estado are pendiente, completada, cancelada, and no_asistio. When the status is set to cancelada, the associated time slot is automatically returned to disponible = true.
POST /admin/medicamentos # Add a medication to the cataloguePUT /admin/medicamentos/:id # Update medication detailsPATCH /admin/medicamentos/:id/estado # Toggle active/inactive
The medication catalogue is used by doctors when composing treatment fields in clinical histories.