API Reference

Every REST endpoint the CargoPRO backend serves at /api — the same API the customer and driver apps are built on.

Overview

Authentication flow

Protected routes sit behind the auth:sanctum middleware. POST /auth/login issues a Sanctum personal access token (token_type: "Bearer"); the login, register and password endpoints are rate-limited by the throttle:login middleware. When a token is missing, expired or revoked the API returns 401 Unauthenticated. — the apps then clear the stored token and return to the login screen.

sequenceDiagram
    autonumber
    participant A as Mobile app
    participant S as CargoPRO API
    A->>S: POST /api/auth/login (username or email + password)
    S-->>A: 200 success, data.token (Bearer)
    A->>S: GET /api/packages/customer with Authorization Bearer token
    S-->>A: 200 success with data rows
    Note over A,S: Token expired, revoked or missing
    A->>S: GET /api/notifications with Authorization Bearer token
    S-->>A: 401 Unauthenticated.
    A->>A: Discard stored token and show login screen
      

Example requests

# 1) Login - username OR email, plus password (min 6 chars)
curl -X POST https://your-domain.com/api/auth/login \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{"username": "demo@devtrixx.com", "password": "secret123"}'

# Response (trimmed)
{
  "success": true,
  "message": "Login successful",
  "data": {
    "token": "1|9abcdefghijKLMNopqrsTUVwxyZ",
    "token_type": "Bearer"
  }
}

# 2) Any authenticated call - send the token as a Bearer header
curl https://your-domain.com/api/packages/customer \
  -H "Accept: application/json" \
  -H "Authorization: Bearer 1|9abcdefghijKLMNopqrsTUVwxyZ"

{
  "success": true,
  "message": "Packages retrieved successfully",
  "data": [ ... ]
}

Authentication & profile

Packages

Shipments

Pickups

Pre-alerts

Notifications

Device tokens (push)

Transactions & invoices

Payments

Catalog & location data

Dashboard, files & driver documents