| Environment | Base URL |
|---|---|
| Staging | https://hlkcc.dev/api |
| Production | https://hlkcc.vip/api |
All authenticated endpoints require a JWT Bearer token:
Authorization: Bearer <token>
Tokens expire after 8 hours. Obtain one via POST /api/auth/login.
curl -X POST https://hlkcc.dev/api/auth/login \
-H "Content-Type: application/json" \
-d '{"email": "user@example.com", "password": "...", "tenant_id": "mm"}'
The login endpoint checks master_users first (no tenant needed), then users with tenant_id.
| Category | Base Path | Auth | Description |
|---|---|---|---|
| Health | /api/health |
No | System health + dashboard stats |
| Auth | /api/auth |
No/Yes | Login, logout, refresh, profile |
| Users | /api/users |
Admin | User CRUD (tenant-scoped) |
| Dashboard | /api/health/dashboard |
No | Live CPU, RAM, uptime stats |
| Security | /api/security |
Yes | Wazuh SIEM integration |
| Logs | /api/logs |
Yes | Audit trail queries |
| Alerts | /api/alerts |
Yes | Discord webhook triggers |
| Kingdom | /api/kingdom |
No | Aggregated service status |
| Category | Base Path | Auth | Description |
|---|---|---|---|
| Products | /api/mm/products |
Staff | Product CRUD |
| Tokens | /api/mm/tokens |
Staff | Access token management |
| Regions | /api/mm/regions |
Staff | Region + inventory |
| Media | /api/mm/media |
Staff | Photo/video upload |
| Analytics | /api/mm/analytics |
Staff | Visitor stats, access logs |
| Groups | /api/mm/groups |
Staff | Client group management |
| Public | /api/mm/public |
No | Token validation, public catalog |
| Member Auth | /api/mm/member |
Varies | Member login, register, profile |
| Member Features | /api/mm/member |
Member | Favorites, orders, messages |
All errors return consistent JSON:
{
"success": false,
"error": "Human-readable error message",
"code": "MACHINE_READABLE_CODE"
}
No rate limiting is currently implemented. All endpoints are protected by JWT authentication and tenant isolation middleware.