Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/Luisanchez0/modulo_Horario/llms.txt

Use this file to discover all available pages before exploring further.

Every protected endpoint in Módulo Horario requires a valid JWT token in the Authorization header. Tokens are issued at login, signed with HS256, and expire after 24 hours. This page shows you how to get a token, use it in requests, and interpret authentication and authorization errors.

​
Getting a token

1

Send a login request

POST your credentials to /auth/login. The correo field is your registered email address.
curl -X POST http://localhost:8001/auth/login \
  -H "Content-Type: application/json" \
  -d '{"correo": "[email protected]", "password": "yourpassword"}'
On success you receive a JSON object containing your token:
{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}
2

Include the token in every protected request

Add an Authorization header with the value Bearer <token> to all subsequent requests.
curl http://localhost:8001/auth/me \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
A valid token returns your user payload:
{
  "sub": "42",
  "correo": "[email protected]",
  "rol": "DOCENTE"
}
3

Re-authenticate when the token expires

Tokens expire after 24 hours. When a token expires, repeat Step 1 to get a new one. There is no silent refresh—your application must detect a 401 response and redirect to login.

​
Roles and access

Módulo Horario uses two roles. Your role is embedded in the token payload and enforced on every request.

DOCENTE

Read access to schedules and resources. Cannot create, update, or delete records.

ADMIN

Full management access. Can create and modify schedules, rooms, subjects, and users. Admin accounts are created separately via /auth/register-admin and require a server-side X-Admin-Key header.

​
Error reference

HTTP statusMeaningWhat to do
401 UnauthorizedToken is missing, malformed, or expiredLog in again to get a fresh token
403 ForbiddenToken is valid but your role cannot perform this actionUse an account with the required role
429 Too Many RequestsMore than 5 login attempts per minute from your IPWait 60 seconds before retrying
422 Unprocessable EntityRequest body is invalid (wrong field types, missing fields)Check your request payload against the schema
Never log, print, or expose your JWT token. It grants full access to your account for up to 24 hours. Treat it like a password.
If you are building a client application, store the token in memory or a secure, HttpOnly cookie. Avoid storing it in localStorage, which is accessible to JavaScript and vulnerable to XSS.

Build docs developers (and LLMs) love

Get started for freeTalk to us