Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/JuanSCaicedo/Api-Ecommerce/llms.txt

Use this file to discover all available pages before exploring further.

API Ecommerce implements a secure, email-based 3-step password reset flow. A unique code is generated, stored against the user record, and emailed to the registered address. The code expires after 60 minutes. No authentication token is required for any of these three endpoints — they are publicly accessible within the /api/auth route group (subject to the 10 requests/minute rate limit).
1

Request Reset Email

POST /api/auth/verified_email
Submit the account’s email address to trigger a password reset email containing a unique verification code.

​
Request Body

​
email
string
required
The email address associated with the account that needs a password reset.

​
Responses

Response bodyMeaning
{"message": 200}Email found — reset code sent successfully.
{"message": 403}No account found with the provided email address.
HTTP 503Site is in maintenance mode.

​
Example Request

curl --request POST \
  --url https://your-domain.com/api/auth/verified_email \
  --header 'Content-Type: application/json' \
  --data '{
    "email": "jane.doe@example.com"
  }'

​
Example Response

{
  "message": 200
}
The code is generated via PHP’s uniqid() function and stored in the code_verified column of the users table. The expiry timestamp is set to Carbon::now()->addMinutes(60) and saved in code_expires_at.
2

Verify the Code

POST /api/auth/verified_code
Validate the code from the reset email before allowing a password change. This step confirms the code exists and has not expired.

​
Request Body

​
code
string
required
The verification code received in the reset email. This is matched against the code_verified column in the users table.

​
Responses

Response bodyMeaning
{"message": 200}Code is valid and has not expired.
{"message": 401}Code was found but has expired (past 60-minute window).
{"message": 403}Code not found — no matching record in the users table.
HTTP 503Site is in maintenance mode.

​
Example Request

curl --request POST \
  --url https://your-domain.com/api/auth/verified_code \
  --header 'Content-Type: application/json' \
  --data '{
    "code": "6659f3e2b4c7a"
  }'

​
Example Response

{
  "message": 200
}
If you receive {"message": 401}, the code has expired. You must restart the flow from Step 1 (POST /api/auth/verified_email) to request a fresh code. Expired codes cannot be reused.
3

Set New Password

POST /api/auth/new_password
Submit the verified code along with the desired new password. On success, the password is updated, and the code_verified and code_expires_at fields are both cleared to null, preventing code reuse.

​
Request Body

​
code
string
required
The same verification code used in Step 2. Must still exist in the code_verified column.
​
new_password
string
required
The new password for the account. Stored as a bcrypt hash.

​
Responses

Response bodyMeaning
{"message": 200}Password updated successfully.
HTTP 503Site is in maintenance mode.

​
Example Request

curl --request POST \
  --url https://your-domain.com/api/auth/new_password \
  --header 'Content-Type: application/json' \
  --data '{
    "code": "6659f3e2b4c7a",
    "new_password": "myNewSecurePass789"
  }'

​
Example Response

{
  "message": 200
}
After a successful password reset, the code_verified and code_expires_at columns are set to null. The code cannot be submitted again — any repeat attempt will return {"message": 403} from Step 2 or silently fail at this step.

​
Full Flow Summary

# Step 1 — Request code
curl --request POST \
  --url https://your-domain.com/api/auth/verified_email \
  --header 'Content-Type: application/json' \
  --data '{"email": "jane.doe@example.com"}'

# Step 2 — Verify code from email
curl --request POST \
  --url https://your-domain.com/api/auth/verified_code \
  --header 'Content-Type: application/json' \
  --data '{"code": "6659f3e2b4c7a"}'

# Step 3 — Set new password
curl --request POST \
  --url https://your-domain.com/api/auth/new_password \
  --header 'Content-Type: application/json' \
  --data '{"code": "6659f3e2b4c7a", "new_password": "myNewSecurePass789"}'

Build docs developers (and LLMs) love

Get started for freeTalk to us