API reference
Public endpoints serve the marketing site. Admin endpoints require a JWT from POST /api/admin/login.
No authentication. Form routes are rate-limited.
| Method | Path | Description |
|---|---|---|
| GET | /api/health | Machine health probe (JSON) |
| GET | /api/content?tables= | Public CMS tables for the website SSR/client |
| POST | /api/contact | Contact form submission + admin email |
| POST | /api/inquiries | Product / project inquiry |
| POST | /api/newsletter | Newsletter subscription |
| POST | /api/applications | Job application with resume upload |
Send Authorization: Bearer <token> unless noted.
| Method | Path | Description |
|---|---|---|
| POST | /api/admin/login | Admin sign-in · returns JWT |
| GET | /api/admin/me | Current admin session · Bearer token |
| GET | /api/admin/dashboard | Dashboard counters · Bearer token |
| GET | /api/admin/stats | Submission stats · Bearer token |
| GET | /api/admin/submissions | All form submissions · Bearer token |
| DELETE | /api/admin/newsletter/:id | Remove a newsletter subscriber · Bearer token |
| GET | /api/admin/users | List admin users · Bearer token |
| POST | /api/admin/users | Create admin user · Bearer token |
| PUT | /api/admin/users/:id | Update admin user · Bearer token |
| DELETE | /api/admin/users/:id | Delete admin user · Bearer token |
| GET | /api/admin/media | List media library · Bearer token |
| POST | /api/admin/media | Upload media asset · Bearer token |
| DELETE | /api/admin/media | Delete media asset · Bearer token |
| GET | /api/admin/cms | List CMS table names / counts · Bearer token |
| GET | /api/admin/cms/:table | Load CMS table rows · Bearer token |
| PUT | /api/admin/cms/:table | Save CMS table rows · Bearer token |
| POST | /api/admin/cms/:table/merge-seed | Merge missing seed rows · Bearer token |
| POST | /api/admin/cms/reseed | Reseed empty CMS from seed file · Bearer token |
| Success body | { "success": true, ... } |
|---|---|
| Error body | { "success": false, "error": "...", "code": "..." } |
| Uploads | Local files under /uploads/* when using the local storage driver; Cloudinary URLs otherwise. |
| CORS | Configured via CORS_ORIGINS for the frontend domain(s). |