iLeben API Reference: Endpoints, Auth, and Rate Limits

The iLeben REST API is a versioned JSON API served under /api/v1. It exposes the platform’s real estate catalog, checkout flow, payment management, reservation system, and site configuration to frontend applications and authorized external clients. All responses use Content-Type: application/json. The API is built on Laravel 12 with Laravel Sanctum for token-based authentication and a custom token.origin middleware that validates the request’s origin against the token’s authorized URL.

Base URL

All endpoints described in this documentation are relative to the versioned base path:

/api/v1

For a production deployment at https://tu-dominio.com, every endpoint is reachable at https://tu-dominio.com/api/v1/{path}.

Discovery Endpoint

Before integrating, you can inspect the full machine-readable route catalog at:

GET /api/v1

This endpoint returns an OpenAPI 3.0.3-style JSON document containing the info block, the servers array (populated with the live base URL), all tags, every path with its operations and security requirements, and the securitySchemes component. No authentication is required to call this endpoint.

curl "https://tu-dominio.com/api/v1"

{
  "openapi": "3.0.3",
  "info": {
    "title": "iLeben API",
    "version": "v1",
    "description": "Documentación base de endpoints para integración frontend y clientes externos."
  },
  "servers": [{ "url": "https://tu-dominio.com/api/v1" }],
  "tags": [
    { "name": "Config" },
    { "name": "Auth" },
    { "name": "Proyectos" },
    { "name": "Plantas" },
    { "name": "Reservas" },
    { "name": "Pagos" },
    { "name": "Checkout" }
  ]
}

Authentication Models

The API enforces three distinct authentication tiers depending on the endpoint group.

Tier	Middleware	Who uses it
Public — no auth required	(none)	Anonymous browsers, webhooks returning payment results
Catalog — Bearer token + origin only	`token.origin`	Frontend apps reading the catalog without a logged-in user
Authenticated — Bearer token + Sanctum session + origin	`auth:sanctum`, `token.origin`	Logged-in buyers performing checkout, reservations, and payment operations

Public endpoints (no authentication)

Method	Path	Notes
`GET`	`/api/v1`	Discovery — OpenAPI-style JSON
`GET`	`/api/v1/site-config`	Global site configuration
`POST`	`/api/v1/contact-submissions`	Lead / contact form submission
`GET`	`/api/v1/payments/public-status/{id}`	Payment result screen (requires `?token=` query param)

Catalog endpoints — `token.origin` only (no `auth:sanctum`)

These endpoints do not require a logged-in user session, but they do require a valid Bearer token and a matching origin header. See Authentication for details on the token.origin middleware.

Method	Path
`GET`	`/api/v1/proyectos`
`GET`	`/api/v1/proyectos/{id}`
`GET`	`/api/v1/plantas`
`GET`	`/api/v1/plantas/{id}`
`GET`	`/api/v1/plantas/filtros-ubicacion`
`GET`	`/api/v1/plantas/proyecto/{projectSlug}/unidad/{unitName}`

Catalog endpoints are protected by token.origin only — they do not require auth:sanctum. A Bearer token with a matching origin header is sufficient to access the full real estate catalog without a user login.

Authenticated endpoints — `auth:sanctum` + `token.origin`

Method	Path
`GET`	`/api/v1/me`
`POST`	`/api/v1/logout`
`GET`	`/api/v1/payment-gateways`
`POST`	`/api/v1/checkout`
`POST`	`/api/v1/reservations`
`GET`	`/api/v1/reservations/planta/{plantId}`
`DELETE`	`/api/v1/reservations/{sessionToken}`
`GET`	`/api/v1/payments`
`GET`	`/api/v1/payments/{id}`
`POST`	`/api/v1/payments/{id}/manual-proof`
`POST`	`/api/v1/payments`
`GET`	`/api/v1/production-sync/export`

Rate Limits

Sensitive write endpoints are throttled per IP to prevent abuse.

Endpoint	Limit
`POST /api/v1/login`	5 requests / minute
`POST /api/v1/register`	5 requests / minute
`POST /api/v1/contact-submissions`	10 requests / minute

Requests exceeding the limit receive a 429 Too Many Requests response. All other endpoints inherit Laravel’s default API throttle.

Full Endpoint Index

The table below lists every route registered under /api/v1 with its HTTP method, authentication requirement, and a short description.

Method	Path	Auth	Description
`GET`	`/api/v1`	Public	OpenAPI-style discovery document
`GET`	`/api/v1/site-config`	Public	Global site configuration; some fields only visible with Bearer token
`POST`	`/api/v1/login`	Public	Authenticate a user and receive a Sanctum Bearer token
`POST`	`/api/v1/register`	Public	Register a new user account
`POST`	`/api/v1/logout`	Sanctum + origin	Revoke the current token and end the session
`GET`	`/api/v1/me`	Sanctum + origin	Return the authenticated user object
`POST`	`/api/v1/contact-submissions`	Public	Submit a contact / lead form
`GET`	`/api/v1/proyectos`	token.origin	Paginated list of real estate projects with filters
`GET`	`/api/v1/proyectos/{id}`	token.origin	Project detail; supports `include_plantas` and `include_asesores`
`GET`	`/api/v1/plantas`	token.origin	Paginated catalog of floor plans with filters
`GET`	`/api/v1/plantas/{id}`	token.origin	Floor plan detail with pricing and availability
`GET`	`/api/v1/plantas/filtros-ubicacion`	token.origin	Available regions and comunas for filter UI
`GET`	`/api/v1/plantas/proyecto/{projectSlug}/unidad/{unitName}`	token.origin	Look up a floor plan by project slug and unit name
`GET`	`/api/v1/payment-gateways`	Sanctum + origin	List payment gateways available for a given `plant_id`
`POST`	`/api/v1/checkout`	Sanctum + origin	Initiate a checkout session (Transbank, MercadoPago, or manual)
`POST`	`/api/v1/reservations`	Sanctum + origin	Create a timed reservation on a floor plan
`GET`	`/api/v1/reservations/planta/{plantId}`	Sanctum + origin	Get the active reservation status for a plant
`DELETE`	`/api/v1/reservations/{sessionToken}`	Sanctum + origin	Release a reservation before it expires
`GET`	`/api/v1/payments`	Sanctum + origin	List all payments for the authenticated user
`GET`	`/api/v1/payments/{id}`	Sanctum + origin	Payment detail
`POST`	`/api/v1/payments`	Sanctum + origin	Create a payment record
`POST`	`/api/v1/payments/{id}/manual-proof`	Sanctum + origin	Upload a bank transfer proof (`multipart/form-data`)
`GET`	`/api/v1/payments/public-status/{id}`	Public	Public payment result lookup (requires `?token=` query param)
`GET`	`/api/v1/production-sync/export`	Sanctum + origin	Export data for production sync

Explore Further

Authentication

How to obtain a Sanctum token, attach it to requests, and satisfy the token.origin middleware.

Catalog

Filtering proyectos and plantas — available query parameters and response fields.

Checkout

Initiate a Transbank, MercadoPago, or manual payment flow from POST /api/v1/checkout.

Payments

Retrieve payment records, upload manual proofs, and check public payment status.

Overview

Public Endpoints

Authenticated Endpoints

iLeben API Reference: Endpoints, Auth, and Rate Limits

Base URL

Discovery Endpoint

Authentication Models

Public endpoints (no authentication)

Catalog endpoints — `token.origin` only (no `auth:sanctum`)

Authenticated endpoints — `auth:sanctum` + `token.origin`

Rate Limits

Full Endpoint Index

Explore Further

Authentication

Catalog

Checkout

Payments

Build docs developers (and LLMs) love

Overview

Public Endpoints

Authenticated Endpoints

Documentation Index

​Base URL

​Discovery Endpoint

​Authentication Models

​Public endpoints (no authentication)

​Catalog endpoints — token.origin only (no auth:sanctum)

​Authenticated endpoints — auth:sanctum + token.origin

​Rate Limits

​Full Endpoint Index

​Explore Further

Authentication

Catalog

Checkout

Payments

Build docs developers (and LLMs) love

Base URL

Discovery Endpoint

Authentication Models

Public endpoints (no authentication)

Catalog endpoints — `token.origin` only (no `auth:sanctum`)

Authenticated endpoints — `auth:sanctum` + `token.origin`

Rate Limits

Full Endpoint Index

Explore Further