Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/fredy-rizo/gestor-backend/llms.txt

Use this file to discover all available pages before exploring further.

Gestor Deportivo uses JSON Web Tokens (JWT) to protect API endpoints. After a user registers, verifies their email, and logs in, they receive a token that must be included with every subsequent request. Tokens are long-lived (365 days) and stored server-side; logging out invalidates them immediately.

​
How authentication works

Every protected route passes through the Token middleware, which reads the access-token request header, verifies the JWT signature, and loads the matching user from MongoDB. If any step fails the request is rejected before it reaches the controller.
The header name is access-token (all lowercase), not Authorization or Bearer. Using the wrong header name will always result in a 403 No hay token response.

​
Registration flow

1

Create an account

Send a POST request to /api/user/register with the user’s personal details. The endpoint also accepts an optional profile image via multipart/form-data.
curl -X POST https://your-api.com/api/user/register \
  -H "Content-Type: application/json" \
  -d '{
    "firstName": "Carlos",
    "lastName": "Ramírez",
    "email": "carlos@example.com",
    "password": "MySecurePass123",
    "sex": "Masculino"
  }'
​
firstName
string
required
User’s first name.
​
lastName
string
required
User’s last name.
​
email
string
required
Email address — must be unique. Stored in lowercase.
​
password
string
required
Plain-text password; hashed before storage.
​
sex
string
required
One of Masculino, Femenino, or Otro.
On success the API creates the account with default role Usuario (value "1") and default activation status Inactivo (value "2"), then emails a 5-digit verification code to the provided address.
2

Verify the email address

Check the inbox for the verification email and submit the code to activate the account.
curl -X POST https://your-api.com/api/user/verify-accounts \
  -H "Content-Type: application/json" \
  -d '{
    "email": "carlos@example.com",
    "code": "34152"
  }'
​
email
string
required
The email address used during registration.
​
code
string
required
The 5-digit code from the verification email.
A successful verification sets the account status to Activo (value "Activo"), allowing the user to log in.
3

Log in

See the Login flow section below to obtain a token.

​
Login flow

Send credentials to /api/user/login. The API checks that the account is active, validates the password, and returns a signed JWT. 
curl -X POST https://your-api.com/api/user/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "carlos@example.com",
    "password": "MySecurePass123"
  }'
​
email
string
required
The registered email address.
​
password
string
required
The account password.
Successful response: 
{
  "message": "Bienvenido",
  "status": true,
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}
​
token
string
The JWT to include in the access-token header on all subsequent requests.
​
status
boolean
true when login succeeds.
The JWT payload contains: id, firstName, lastName, email, avatar, sex, idTeam, idPlayer, roles, and activate. Tokens expire after 365 days.

​
Passing the token

Include the token in the access-token header on every protected request: 
curl -X POST https://your-api.com/api/team/to-list \
  -H "access-token: YOUR_JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"pag": 1, "perpage": 10}'

​
Token expiry

Tokens are valid for 365 days from the moment of login. After expiry the API returns a 401 response and the user must log in again to obtain a fresh token.

​
Logout

Logging out clears the token stored server-side, invalidating it immediately even though the JWT itself has not expired. 
curl -X POST https://your-api.com/api/user/logout \
  -H "Content-Type: application/json" \
  -d '{"email": "carlos@example.com"}'
​
email
string
required
The email address of the user to log out.

​
Error responses

HTTP StatusMessageCause
403No hay tokenaccess-token header is missing from the request
401Token inexistenteToken is present but invalid or malformed
404No hay usuarioToken is valid but the user no longer exists in the database

​
Password recovery

If a user forgets their password, a two-step recovery flow resets it via an emailed code.
1

Request a recovery code

curl -X POST https://your-api.com/api/user/recovery-pass \
  -H "access-token: YOUR_JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"email": "carlos@example.com"}'
The API generates a 5-digit recovery code and emails it to the address provided.
2

Submit the new password

curl -X POST https://your-api.com/api/user/update-password \
  -H "Content-Type: application/json" \
  -d '{
    "email": "carlos@example.com",
    "code_confirm_pass": "82341",
    "newPassword": "NewSecurePass456"
  }'
​
email
string
required
The account email address.
​
code_confirm_pass
string
required
The 5-digit recovery code from the email.
​
newPassword
string
required
The desired new password.
On success the password is updated and the recovery code is cleared.

​
Roles

Every user carries a roles array in their JWT payload and MongoDB document. Gestor Deportivo ships with two built-in roles:

Usuario

Default role assigned at registration. name: "Usuario", value: "1". Subject to membership plan limits (e.g., maximum teams).

Admin

Elevated role for platform administrators. name: "Admin", value: "2". Bypasses all resource limits and can manage other users’ data.

Build docs developers (and LLMs) love

Get started for freeTalk to us