Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/JuanSCaicedo/Api-Ecommerce/llms.txt

Use this file to discover all available pages before exploring further.

API Ecommerce uses Laravel’s built-in ThrottleRequests middleware (aliased as throttle) to protect sensitive endpoints from abuse. The middleware tracks request counts in a sliding 1-minute window keyed by the caller’s IP address. Once the configured limit is reached all subsequent requests within that window are rejected with an HTTP 429 Too Many Requests response, and the caller must wait until the window resets before trying again.
The /api/auth/* group — including register, login, and login_ecommerce — share the same 10 requests per minute limit. Hitting that limit while registering will also block login attempts from the same IP, and vice versa.

​
Limits by group

Endpoint groupAffected routesLimit
Auth group (/api/auth/*)All auth routes: register, login, login_ecommerce, logout, logout_device, refresh, me, verified_auth, verified_email, verified_code, new_password10 req / min
Admin mutating operations (/api/admin/*)store, update, destroy (and delete_imagen where applicable) on ProductController, SliderController, and CuponeController10 req / min
Cart mutating operations (/api/ecommerce/cart)store, update, destroy on CartController20 req / min
Public storefront GET endpoints (/api/ecommerce/*)home, menu, product/, config-filter-advance, filter-advance-productNo throttle
DiscountController does not declare a constructor-level throttle. Its write routes (store, update, destroy) are protected by auth:api only. If you need throttling on discount writes, add the middleware in DiscountController::__construct().
The throttle is applied at two levels in the codebase:
  1. Route group level — the auth prefix group sets 'middleware' => 'throttle:10,1' in routes/api.php.
  2. Controller constructor level — selected admin and cart controllers call $this->middleware('throttle:N,1')->only([...]) so the limit applies only to write methods:
// Admin ProductController — 10 req/min on writes
public function __construct()
{
    $this->middleware('throttle:10,1')
         ->only(['update', 'store', 'destroy', 'delete_imagen']);
}

// Admin SliderController — 10 req/min on writes
public function __construct()
{
    $this->middleware('throttle:10,1')
         ->only(['update', 'store', 'destroy']);
}

// Admin CuponeController — 10 req/min on writes
public function __construct()
{
    $this->middleware('throttle:10,1')
         ->only(['update', 'store', 'destroy', 'delete_imagen']);
}

// Ecommerce CartController — 20 req/min on writes
public function __construct()
{
    $this->middleware('throttle:20,1')
         ->only(['update', 'store', 'destroy']);
}
The throttle:N,1 signature means N requests per 1 minute. Laravel stores the counter in whichever cache driver is configured (file by default; Redis recommended — see Caching).

​
429 response

When a client exceeds its rate limit, Laravel returns the following response: 
HTTP/1.1 429 Too Many Requests
Content-Type: application/json
Retry-After: 60
X-RateLimit-Limit: 10
X-RateLimit-Remaining: 0

{
  "message": "Too Many Requests"
}
The Retry-After header contains the number of seconds remaining until the rate-limit window resets. Clients must respect this value and back off before retrying.

​
Best practices

  • Cache responses client-side. Public storefront endpoints (/api/ecommerce/home, /api/ecommerce/menu, /api/ecommerce/product/{slug}) are already cached server-side for 30 days (2592000 seconds). Store the response in your client application and re-fetch only when the cached copy is stale.
  • Avoid polling. Do not repeatedly call authenticated endpoints (cart index, order status) on a timer. Trigger refetches on user actions instead.
  • Use bulk operations. The cart delete_all endpoint (DELETE /api/ecommerce/cart/delete_all) removes the entire cart in a single request, rather than issuing individual destroy calls for each item — keeping you well within the 20 req/min cart limit.
  • Handle 429 gracefully. Read the Retry-After header value and schedule the retry after the indicated number of seconds. Display a user-friendly message in the UI rather than silently retrying in a tight loop.

Build docs developers (and LLMs) love

Get started for freeTalk to us