REST API reference

Build clear client-workflows on Note Tracker.

A tenant-safe Laravel API for projects, notes, public collaboration, private attachments, update requests, mail delivery, and auditable workspace administration.

85 documented endpointsJSON over HTTPSLaravel SanctumCheck API health ↗

Quick start

Make your first request

All authenticated endpoints live under /api. Send JSON with an Accept: application/json header and use the token returned by login.

Base URL

http://hamza.abdalrhman.dev/notetracker/note-tracker-backend/public/api

Content type

application/json, except multipart uploads.

Health

GET /api/health requires no token.

curl -X POST 'http://hamza.abdalrhman.dev/notetracker/note-tracker-backend/public/api/auth/login' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "email": "alice@example.com",
    "password": "your-password",
    "device_name": "integration"
  }'

Security

Bearer authentication

The login endpoint returns a Sanctum token. Store it securely and attach it to subsequent requests. Logout revokes only the current token; refresh rotates it.

curl 'http://hamza.abdalrhman.dev/notetracker/note-tracker-backend/public/api/projects' \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer YOUR_TOKEN'

Isolation

Tenancy and roles

Tenant members

The organization is resolved from the authenticated account. Cross-tenant model identifiers return 404.

Super administrators

Platform routes use /api/admin. A selected tenant context may be supplied with X-Organization-ID where supported.

Role model

super_admin, org_admin, editor, and viewer. Suspended tenants remain readable but cannot mutate data.

Response contract

Status and error conventions

StatusMeaningTypical shape
200 / 201Successful read or creationResource key or paginated data
401Missing or invalid token{"message":"Unauthenticated."}
403Role/policy denial or suspended mutation{"message":"…"}
404Missing or cross-tenant resource{"message":"Not Found"}
409 / 410Used, revoked, or expired one-time flow{"message":"…"}
422Validation failure{"message":"…","errors":{…}}
423Attachment has not passed scanning{"message":"…"}
429Rate limit exceededStandard Laravel throttle response

Private files

Attachment lifecycle

Uploads enter private quarantine with scan_status=pending. A worker streams them to ClamAV. Clean files become previewable; infected files are deleted; scanner errors remain fail-closed and can be retried by an organization administrator.

curl -X POST 'http://hamza.abdalrhman.dev/notetracker/note-tracker-backend/public/api/notes/42/attachments' \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -F 'file=@./screenshot.png'

Complete catalog

Endpoint reference

Search by method, path, capability, or access level. Path parameters use braces; list endpoints return Laravel pagination metadata where applicable.

System

2 endpoints
GET /api/health API health checkReturns {"status":"ok"}. Public
GET /api/public/ping Public API health checkChecks availability of the unauthenticated API surface. Public

Authentication & registration

13 endpoints
POST /api/auth/login Create an API tokenJSON: email, password, optional device_name. Public
POST /api/auth/logout Revoke the current tokenRevokes the token used for this request. Bearer
POST /api/auth/refresh Rotate the current tokenReturns a replacement Sanctum bearer token. Bearer
GET /api/auth/me Get the current accountReturns the authenticated user and resolved organization context. Bearer
POST /api/auth/forgot-password Request a password resetJSON: email. Always returns a safe non-enumerating response. Public
POST /api/auth/reset-password Reset a passwordJSON: email, token, password, password_confirmation. Public
POST /api/auth/reset-password/revoke-sessions Revoke reset-related sessionsJSON: session_management_token. Public
POST /api/register Start workspace registrationJSON: name, email, password, terms_accepted. Phone and job title are optional. Public
GET /api/register/{token} Read registration progressReturns the current step and safe registration summary. Public
POST /api/register/{token}/verify Verify registration emailJSON: code (six digits). Public
POST /api/register/{token}/resend Resend verification codeRate limited to prevent abuse. Public
PUT /api/register/{token}/organization Save workspace detailsJSON: name, slug, optional phone, job_title, and settings. Public
POST /api/register/{token}/complete Provision the workspaceCompletes registration and returns an authenticated session. Public

Platform administration

5 endpoints
GET /api/admin/organizations List organizationsPaginated platform-wide organization list. Super admin
POST /api/admin/organizations Create an organizationCreates and provisions a tenant workspace. Super admin
GET /api/admin/organizations/{organization}/stats Organization statisticsReturns note, project, member, attachment, and storage totals. Super admin
POST /api/admin/organizations/{organization}/suspend Suspend an organizationMakes tenant mutations read-only. Super admin
POST /api/admin/organizations/{organization}/activate Activate an organizationRestores normal tenant mutations. Super admin

Organization

4 endpoints
POST /api/organizations Create my organizationJSON: name and slug. Creates a workspace and makes the current account its Org Admin. Bearer
GET /api/organization Get organization settingsReturns branding, settings, and current workspace information. Member
PUT /api/organization Update organization settingsAccepts name, slug, and supported settings fields. Org admin
POST /api/organization/logo Upload organization logoMultipart: logo. JPEG, PNG, GIF, or WebP up to 5 MB. Org admin

Projects

7 endpoints
GET /api/projects List projectsPaginated tenant-scoped project collection. Member
POST /api/projects Create a projectJSON: name, optional description, key, member_ids. Editor+
GET /api/projects/{project} Get a projectReturns project details and related metadata. Member
PUT /api/projects/{project} Update a projectPartial JSON update for name, description, key, members, status, or progress. Editor+
DELETE /api/projects/{project} Delete a projectSoft-deletes the project according to policy. Editor+
POST /api/projects/{project}/share Create or refresh a share linkReturns the public project share token and URL. Editor+
DELETE /api/projects/{project}/share Revoke a share linkImmediately invalidates the active project link. Editor+

Notes

13 endpoints
GET /api/projects/{project}/notes List project notesSupports pagination and server-side note filters. Member
POST /api/projects/{project}/notes Create a noteJSON: title, content, optional type, note_status_id, assignee_ids, label_ids. Editor+
POST /api/notes/bulk-labels Bulk update note labelsJSON: note_ids, label_ids, operation (add, remove, or replace). Editor+
GET /api/notes/{note} Get a noteReturns note, assignments, labels, status, and attachments. Member
PUT /api/notes/{note} Update a notePartial JSON update of editable note fields. Editor+
DELETE /api/notes/{note} Delete a noteSoft-deletes the note. Editor+
POST /api/notes/{note}/status Change note statusJSON: note_status_id. Adds a status-change timeline event. Editor+
POST /api/notes/{note}/request-update Request an external updateJSON: recipient_email and optional message. Editor+
POST /api/notes/{note}/reply Post a replyJSON: content and optional mentioned_user_ids. Editor+
GET /api/notes/{note}/timeline Get note timelineChronological creation, update, reply, status, label, and attachment events. Member
GET /api/notes/{note}/update-requests List update requestsReturns active, used, expired, and revoked update links. Member
DELETE /api/notes/{note}/update-requests/{shareToken} Revoke an update requestInvalidates a single external update link. Editor+
POST /api/notes/{note}/update-requests/{shareToken}/resend Resend an update requestQueues another delivery of the existing request. Editor+

Attachments

5 endpoints
POST /api/notes/{note}/attachments Upload an attachmentMultipart: file, maximum 50 MB. The response begins with scan_status=pending. Editor+
GET /api/attachments/{attachment} Get attachment metadataReturns scan status, preview kind, size, hashes, and download URL. Member
GET /api/attachments/{attachment}/download Download an attachmentReturns HTTP 423 until the malware scan is clean. Member
POST /api/attachments/{attachment}/rescan Retry a failed scanAllowed only when scan_status=error and the quarantined object exists. Org admin
DELETE /api/attachments/{attachment} Delete an attachmentDeletes both the private object and attachment record. Editor+

Members

6 endpoints
GET /api/users List organization membersTenant-scoped member collection. Member
POST /api/users/invite Add a memberJSON: name, email, role. Existing accounts retain their credentials. Org admin
PUT /api/users/{user}/role Change membership roleUpdates the role only in the selected organization. Org admin
PATCH /api/users/{user}/access Enable or disable membershipJSON: enabled. Disabled memberships preserve assignments. Org admin
DELETE /api/users/{user} Remove a membershipDetaches current assignments without deleting the global account. Org admin
POST /api/users/{user}/resend-invitation Resend an invitationQueues another invitation email. Org admin

Statuses & labels

10 endpoints
GET /api/statuses List note statusesOrdered tenant status collection. Member
POST /api/statuses Create a statusJSON: label, tone_key, optional sort_order. Org admin
PUT /api/statuses/{status} Update a statusPartial status update. Org admin
DELETE /api/statuses/{status} Delete a statusProtected when the status is still in use. Org admin
POST /api/statuses/reorder Reorder statusesJSON: ids in the desired order. Org admin
GET /api/labels List note labelsOrdered tenant label collection. Member
POST /api/labels Create a labelJSON: name, color (#RRGGBB), optional sort_order. Org admin
PUT /api/labels/{label} Update a labelPartial label update. Org admin
DELETE /api/labels/{label} Delete a labelDetaches and deletes the label. Org admin
POST /api/labels/reorder Reorder labelsJSON: label_ids in the desired order. Org admin

Requests, activity & notifications

7 endpoints
GET /api/pending-requests List pending public note requestsReturns unmoderated requests and their scanned images. Member
POST /api/pending-requests/{pendingNoteRequest}/approve Approve a pending requestCreates a normal note from the public submission. Editor+
POST /api/pending-requests/{pendingNoteRequest}/reject Reject a pending requestRejects and removes its quarantined attachments. Editor+
GET /api/activity-logs List activity logsPaginated tenant audit trail. Member
GET /api/notifications List current-user notificationsReturns unread and recent notification records. Bearer
POST /api/notifications/read-all Mark all notifications readUpdates all unread notifications for the current user. Bearer
POST /api/notifications/{id}/read Mark one notification readOnly affects a notification owned by the current user. Bearer

Mail & outbound messages

8 endpoints
GET /api/mail-settings Get mail configurationReturns safe SMTP state and notification preferences; secrets are never returned. Org admin
PUT /api/mail-settings Update mail configurationStores SMTP credentials encrypted. Org admin
POST /api/mail-settings/test Send a test emailValidates the pending SMTP settings. Org admin
POST /api/mail-settings/activate Activate organization mailEnables the tested configuration. Org admin
POST /api/mail-settings/deactivate Deactivate organization mailFalls back to platform mail behavior. Org admin
GET /api/outbound-messages List outbound messagesPaginated encrypted outbox and delivery state. Org admin
GET /api/outbound-messages/{outboundMailMessage} Get an outbound messageReturns one tenant-scoped message record. Org admin
POST /api/outbound-messages/{outboundMailMessage}/resend Resend an outbound messageQueues another delivery attempt. Org admin

Public sharing

5 endpoints
GET /api/public/organizations/{organization}/logo Read public organization logoReturns only the public branding asset. Public
GET /api/public/p/{token} Open a shared projectReturns project branding, global notes, and public-safe timelines. Public
POST /api/public/p/{token}/request-note Request a new noteMultipart or JSON: name, email, title, details, optional image attachments. Public
GET /api/public/update/{token} Open an update requestReturns a safe note/request summary and token state. Public
POST /api/public/update/{token} Submit a one-time updateMultipart: name, email, message, optional six-digit code and attachments/files. Public
No endpoints match that search.