API Overview

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/Ishaq74/concordia/llms.txt

Use this file to discover all available pages before exploring further.

​

API Architecture

​

Base URL Structure

https://your-domain.com/api/{resource}

​

Endpoint Categories

• Authentication: /api/auth/* - Better Auth endpoints (login, register, session)
• Admin Blog: /api/admin/blog/* - Blog management (articles, authors, categories, comments, media)
• Admin Services: /api/admin/services/* - Services management (services, categories, availability, bookings, media)
• Admin Organizations: /api/admin/organizations/* - Organization and member management
• Client Auth: /api/auth-client/* - Client-side auth helpers (verification, password reset)
• Profile: /api/profile/* - User profile management

​

Request/Response Patterns

​

Request Format

{
  "action": "create",
  "field1": "value1",
  "field2": "value2"
}

​

Response Format

{
  "ok": true,
  "id": "xyz123",
  "data": { ... }
}

{
  "error": "not_found",
  "message": "Resource not found"
}

​

HTTP Status Codes

​

Authentication Requirements

​

Admin Endpoints

1. Active session (cookie or Bearer token)
2. Admin role (checked via guardAdmin helper)

const guard = guardAdmin(locals);
if (guard) return guard; // Returns 403 if not admin

​

Public Endpoints

• /api/auth/* - Open for authentication flows
• /api/auth-client/* - Open for email verification and password reset

​

Session Management

• Cookie-based sessions (default)
• Bearer token support (for API clients)
• Session duration: 7 days
• Session refresh: Every 24 hours
• Absolute timeout: 7 days

​

Rate Limiting

​

Configuration

rateLimit: {
  enabled: true,
  storage: "database",
  skipSuccessfulRequests: false,
  skipFailedRequests: false,
  windows: [
    {
      key: "global_ip",
      max: 100,
      window: 60 * 1000, // 1 minute
    },
    {
      key: "sign_in",
      max: 5,
      window: 15 * 60 * 1000, // 15 minutes
    },
    {
      key: "sign_up",
      max: 10,
      window: 60 * 60 * 1000, // 1 hour
    },
  ],
}

​

Rate Limits

​

Rate Limit Headers

• HTTP 429 Too Many Requests
• Error message: "Too many login attempts" or similar

​

Error Handling

​

Common Error Codes

​

Error Response Example

{
  "error": "missing_action",
  "message": "The 'action' field is required"
}

​

Security Headers

const securityHeaders = {
  'content-security-policy': "default-src 'none'; frame-ancestors 'none'; base-uri 'none';",
  'x-frame-options': 'DENY',
  'x-content-type-options': 'nosniff',
  'strict-transport-security': 'max-age=63072000; includeSubDomains; preload',
  'referrer-policy': 'no-referrer',
  'content-type': 'application/json',
};

​

Pagination

GET /api/admin/blog/articles?page=2&perPage=20

​

Parameters

​

Response Format

{
  "articles": [...],
  "total": 150,
  "page": 2,
  "perPage": 20,
  "totalPages": 8
}

​

Filtering & Search

• q - Text search (slug, title, email, etc.)
• status - Filter by status (draft, published, etc.)
• featured - Filter featured items (true/false)
• category - Filter by category ID
• organizationId - Filter by organization

​

Example

GET /api/admin/blog/articles?q=welcome&status=published&featured=true

​

Audit Logging

await db.insert(auditLog).values({
  id: generateId(),
  action: "blog.article.create",
  userId,
  targetId: id,
  data: { slug, status },
  createdAt: new Date(),
});

​

Logged Actions

• All CRUD operations (create, update, delete)
• Authentication events (login, logout, signup)
• Member management (invite, remove, role changes)
• Content publication (publish, unpublish)

​

API Endpoints by Category

​

Authentication & Users

• Authentication API - Login, registration, email verification, password reset
• Profile API - User profile management (GET, PATCH)
• Users API - Admin user management, roles, bans, sessions

​

Content Management

• Blog API - Articles, authors, categories, comments, media

​

Services & Bookings

• Services API - Service listings, categories, availability, bookings (admin)
• Public Bookings API - Customer-facing booking creation

​

Organizations

• Organizations API - Organization CRUD, members, invitations, profiles

​

Next Steps