Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/fredy-rizo/Ecommerce/llms.txt

Use this file to discover all available pages before exploring further.

The Ecommerce API uses JSON Web Tokens (JWT) as its primary authentication mechanism. A token is issued at login and must accompany every subsequent request to a protected endpoint via the token-access header. This page walks through the complete lifecycle — from creating an account to recovering a forgotten password — and explains how role-based access works once you are authenticated.

​
Registration and login flow

1

Register a new account

Send a POST request to /api/user/register with all required user fields. The account is created with an inactive status (Inactivo, value "2") and a 5-digit verification code is dispatched to the provided email address.
curl -X POST https://your-api-domain.com/api/user/register \
  -H "Content-Type: application/json" \
  -d '{
    "firstName": "John",
    "lastName": "Doe",
    "email": "john@example.com",
    "password": "SuperSecret123",
    "phone": "3001234567",
    "sex": "Masculino",
    "document": "123456789",
    "documentType": "CC",
    "birthdate": "1995-06-15"
  }'
​
firstName
string
required
The user’s first name.
​
lastName
string
required
The user’s last name.
​
email
string
required
Email address — used for verification codes and login.
​
password
string
required
Plain-text password; the API stores it hashed.
​
phone
string
required
Contact phone number.
​
sex
string
required
Gender identifier. Accepted values: "Masculino", "Femenino", "Otro".
​
document
string
required
Identity document number.
​
documentType
string
required
Type of identity document. Accepted values: "CC", "CE", "Pasaporte".
​
birthdate
string
required
Date of birth in YYYY-MM-DD format.
2

Check your email for the verification code

After a successful registration, the API sends a 5-digit numeric code to the email address you provided. Check your inbox (and spam folder) for this code — you will need it in the next step.
The verification code is single-use and tied to the registered email address. It does not expire automatically, but attempting to verify an already-active account will return an error.
3

Verify the account

Submit the 5-digit code alongside the registered email to POST /api/user/verify-account. On success, the account’s activate status is updated to Activado (value: "1") and the account is now eligible to log in.
curl -X POST https://your-api-domain.com/api/user/verify-account \
  -H "Content-Type: application/json" \
  -d '{
    "email": "john@example.com",
    "code": "47392"
  }'
​
email
string
required
The email address used during registration.
​
code
string
required
The 5-digit verification code received by email.
4

Log in and receive your JWT

Once the account is active, call POST /api/user/login with your credentials. The API responds with a signed JWT valid for 365 days.
curl -X POST https://your-api-domain.com/api/user/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "john@example.com",
    "password": "SuperSecret123"
  }'
​
email
string
required
The registered email address.
​
password
string
required
The account password.
​
token
string
Signed JWT to use in the token-access header for all protected requests.
​
user
object
Full snapshot of the authenticated user, including role and activation status.
Tokens expire after 365 days. There is no refresh-token endpoint; users must log in again once the token expires. The issued token is also stored on the User document in the database and is re-verified by the Token middleware on every request.
5

Use the token on protected requests

Include the token in the token-access header for every call to a protected endpoint. The middleware reads this header, verifies the JWT signature against config.SECRET, and resolves the full user document before passing control to the route handler.
curl -X GET https://your-api-domain.com/api/products \
  -H "token-access: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
The header name is token-access — not Authorization. The Token middleware will return 403 { "msj": "Sin token" } if the header is absent, and 401 { "msj": "Token inexistente", "status": false } if the token cannot be verified.

​
Token payload reference

The JWT encodes the following claims at the time of login:
ClaimTypeDescription
idstringMongoDB _id of the user document
userNamestringDisplay name
emailstringEmail address
phonestringPhone number
sexstringGender field (Masculino, Femenino, Otro)
documentstringIdentity document number
documentTypestringType of identity document (CC, CE, Pasaporte)
birthdatestringDate of birth
rolesarrayRole objects — see Role-based access
activatearrayActivation status objects

​
Password recovery

If a user forgets their password, the API provides a two-step reset flow that does not require the user to be logged in.

​
Step 1 — Request a reset code

POST /api/user/recovery-password sends a 5-digit code to the account’s registered email. 
curl -X POST https://your-api-domain.com/api/user/recovery-password \
  -H "Content-Type: application/json" \
  -d '{ "email": "john@example.com" }'
​
email
string
required
The email address associated with the account.

​
Step 2 — Set the new password

POST /api/user/update-password accepts the code from the email together with the new password. 
curl -X POST https://your-api-domain.com/api/user/update-password \
  -H "Content-Type: application/json" \
  -d '{
    "email": "john@example.com",
    "code_confirm_pass": "83021",
    "newPassword": "AnotherSecret456"
  }'
​
email
string
required
The email address associated with the account.
​
code_confirm_pass
string
required
The 5-digit reset code received by email.
​
newPassword
string
required
The new password to set for the account.

​
Role-based access

Every user has a roles array embedded in their token payload. The API currently defines two roles:

Usuario (value: 1)

Standard customer role. Can browse products, manage their own cart, and place orders. Assigned by default to all newly registered accounts.

Admin (value: 2)

Administrator role. Can create, update, and delete products, and retrieve the full list of users. Must be assigned manually in the database.
Protected routes that require the Admin role will verify that the roles array in the resolved user document contains an entry with value: "2". Standard users attempting to access admin-only endpoints will receive a 403 or 401 response depending on how the route guard is implemented.
Because role information is embedded in the JWT, the token payload reflects the roles that were active at the time of login. If an admin manually changes a user’s role in the database, the user must log in again to receive a token with the updated role.

Build docs developers (and LLMs) love

Get started for freeTalk to us