Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/JuanSCaicedo/Api-Ecommerce/llms.txt

Use this file to discover all available pages before exploring further.

API Ecommerce is a monolithic Laravel 10 application that follows the Model-View-Controller (MVC) pattern and exposes a stateless REST JSON API. Two Angular front-end clients consume the API: a customer-facing storefront and a back-office admin panel. All communication is JSON over HTTPS — there are no server-rendered views.

​
Route groups

All routes are registered under /api and are split into three top-level prefix groups defined in routes/api.php:

​
/api/auth/

Handles identity operations: registration, login (admin and storefront), logout, token refresh, email verification, and password reset. Every route in this group is rate-limited to 10 requests per minute via throttle:10,1. 
Route::group([
    'middleware' => 'throttle:10,1',
    'prefix' => 'auth'
], function ($router) {
    Route::post('/register',        [AuthController::class, 'register']);
    Route::post('/login',           [AuthController::class, 'login']);
    Route::post('/login_ecommerce', [AuthController::class, 'login_ecommerce']);
    Route::post('/logout',          [AuthController::class, 'logout']);
    Route::post('/logout_device',   [AuthController::class, 'logout_device']);
    Route::post('/refresh',         [AuthController::class, 'refresh']);
    Route::post('/me',              [AuthController::class, 'me']);
    Route::post('/verified_auth',   [AuthController::class, 'verified_auth']);
    Route::post('/verified_email',  [AuthController::class, 'verified_email']);
    Route::post('/verified_code',   [AuthController::class, 'verified_code']);
    Route::post('/new_password',    [AuthController::class, 'new_password']);
});

​
/api/admin/

Protected admin surface for catalogue management (products, categories, brands, attributes, variations, specifications), marketing tools (discounts, coupons, sliders), and home-view configuration. Every route requires a valid JWT via auth:api middleware — there is no public endpoint in this group. 
Route::group([
    'middleware' => 'auth:api',
    'prefix' => 'admin'
], function ($router) {
    Route::resource('products',   ProductController::class);
    Route::resource('categories', CategorieController::class);
    Route::resource('discounts',  DiscountController::class);
    Route::resource('sliders',    SliderController::class);
    // ... all other admin resources
});
Selected admin controllers apply an additional throttle:10,1 constraint on mutating actions, declared at the controller constructor level. For example, ProductController, SliderController, and CuponeController all do this: 
// ProductController and SliderController
public function __construct()
{
    $this->middleware('throttle:10,1')
         ->only(['update', 'store', 'destroy', 'delete_imagen']);
}
DiscountController does not declare a constructor-level throttle — its write actions are protected only by auth:api.

​
/api/ecommerce/

Customer-facing storefront surface. Public read endpoints (home page, menu, product detail, advanced filters) are accessible without authentication. A nested sub-group adds auth:api for cart management, checkout, order history, user profile, and reviews. 
Route::group(['prefix' => 'ecommerce'], function ($router) {
    // Public endpoints — no auth, no throttle
    Route::get('home',                    [HomeController::class, 'home']);
    Route::get('menu',                    [HomeController::class, 'menu']);
    Route::get('product/{slug}',          [HomeController::class, 'show_product']);
    Route::get('config-filter-advance',   [HomeController::class, 'config_filter_advance']);
    Route::post('filter-advance-product', [HomeController::class, 'filter_advance_product']);

    // Authenticated sub-group
    Route::group(['middleware' => 'auth:api'], function ($router) {
        Route::delete('cart/delete_all',         [CartController::class, 'delete_all']);
        Route::post('cart/apply_cupon',          [CartController::class, 'apply_cupon']);
        Route::resource('cart',                  CartController::class);
        Route::resource('user_address',          UserAdressController::class);
        Route::post('checkout',                  [SaleController::class, 'store']);
        Route::post('checkout-temp',             [SaleController::class, 'checkout_temp']);
        Route::get('sale/{id}',                  [SaleController::class, 'show']);
        Route::get('mercadopago',                [SaleController::class, 'mercadopago']);
        Route::post('checkout-mercadopago',      [SaleController::class, 'checkout_mercadopago']);
        Route::get('profile_client/me',          [AuthController::class, 'me']);
        Route::post('profile_client',            [AuthController::class, 'update']);
        Route::get('profile_client/orders',      [SaleController::class, 'orders']);
        Route::resource('reviews',               ReviewController::class);
    });
});
Cart mutating operations (store, update, destroy) are additionally rate-limited to 20 requests per minute via the CartController constructor: 
public function __construct()
{
    $this->middleware('throttle:20,1')
         ->only(['update', 'store', 'destroy']);
}

​
Middleware stack

The following middleware are relevant to API consumers:
Alias / ClassWhere appliedPurpose
HandleCorsGlobalAdds CORS headers to every response
PreventRequestsDuringMaintenanceGlobalReturns 503 when the app is in maintenance mode
ThrottleRequests (:api named limiter)api middleware groupDefault rate limiter applied to all routes under /api
ThrottleRequests (throttle:N,M)Route group / constructorEnforces per-IP request rate limits (sliding 1-minute window) on specific groups
auth:apiRoute group / constructorValidates the JWT Bearer token using the api guard (tymon/jwt-auth)
SubstituteBindingsapi middleware groupResolves route model bindings
The api middleware group (applied automatically to all routes in routes/api.php) is defined in Kernel.php as: 
'api' => [
    \Illuminate\Routing\Middleware\ThrottleRequests::class.':api',
    \Illuminate\Routing\Middleware\SubstituteBindings::class,
],
Chaining order for a protected, throttled endpoint (e.g. POST /api/auth/login):
  1. Global middleware runs first: CORS headers are set, maintenance status is checked.
  2. The api middleware group’s default ThrottleRequests:api named limiter runs.
  3. The route-group throttle:10,1 middleware inspects the request count for the caller’s IP within the current 1-minute window. If the limit is exceeded a 429 Too Many Requests response is returned immediately.
  4. auth:api (on routes that require it) decodes and validates the Authorization: Bearer <token> header. An invalid or missing token returns 401 Unauthorized.
  5. The request reaches the controller.

​
Request lifecycle

The following numbered sequence describes the full journey of a single HTTP request through the stack:
  1. HTTP request arrives at the Laravel application entry point (public/index.php).
  2. Route resolution — Laravel matches the URI and HTTP method against the registered route table and identifies the target controller action.
  3. Global middleware — HandleCors, PreventRequestsDuringMaintenance, ValidatePostSize, and TrimStrings run in sequence.
  4. Throttle check — ThrottleRequests evaluates the per-IP counter stored in the cache. If the limit is exceeded the pipeline halts and a 429 response is returned.
  5. JWT verification — On guarded routes, auth:api calls auth('api')->check(). The JWT is decoded, the user record is loaded from MySQL, and the authenticated user is bound to the request context. Failure returns 401.
  6. Controller action — The resolved method executes business logic, calling Eloquent models which issue SQL queries against MySQL.
  7. Cache layer — Read-heavy storefront endpoints call Cache::remember() before querying the database. Write operations call Cache::flush() to invalidate stale data.
  8. JSON response — The controller returns a response()->json([...]) value. Laravel serialises it as application/json and sends it back to the client.

​
User roles

The users table has a type_user integer column that controls which login endpoint a user may use and which parts of the API they can access.
Roletype_user valueLogin endpointAccess scope
Admin1POST /api/auth/loginFull access to /api/admin/* and all authenticated /api/ecommerce/* routes
Customer2POST /api/auth/login_ecommerceAuthenticated /api/ecommerce/* routes only (cart, checkout, orders, profile, reviews)
Guest—(no login required)Public /api/ecommerce/* GET endpoints (home, menu, product detail, filters)
Customers must verify their email before a JWT is issued. The login_ecommerce action checks email_verified_at and returns 401 Unauthorized if the field is null.

​
Data storage

StoreTechnologyUsed for
Relational databaseMySQLUsers, products, categories, brands, variations, specifications, carts, orders, discounts, coupons, reviews, sliders, home views
Object storageOCI Object Storage (configured as the oci disk)Product cover images, gallery images, slider images, user avatars, order payment receipts (comprobantes)
CacheLaravel Cache (file driver by default; Redis recommended for production)Storefront page responses, product detail pages, menu categories, maintenance status flag

Build docs developers (and LLMs) love

Get started for freeTalk to us