API Reference

Complete REST API documentation for Fastly

All API endpoints are available under the /api/ path. This reference covers authentication, user management, and session endpoints.

Base URL

http://localhost:3000/api

For production, replace with your domain.

Authentication

Protected endpoints require two headers:

Authorization: Bearer <access-token>
X-Session-Id: <session-id>

Both values are returned from login, OAuth, or email verification endpoints.

Access tokens expire after 15 minutes. Use the refresh token endpoint to get new tokens.

Response Format

All responses follow a consistent structure:

Success Response

{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    // Response data here
  },
  "timestamp": "2024-01-15T10:30:00.000Z",
  "requestId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}

Error Response

{
  "success": false,
  "message": "Error description",
  "errors": [
    // Validation errors or additional details
  ],
  "timestamp": "2024-01-15T10:30:00.000Z",
  "requestId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}

HTTP Status Codes

CodeDescriptionWhen Used
200OKSuccessful GET, POST, DELETE
201CreatedResource created successfully
400Bad RequestInvalid input or validation error
401UnauthorizedMissing or invalid token
403ForbiddenValid token but insufficient permissions
404Not FoundResource doesn't exist
409ConflictResource already exists (e.g., duplicate email)
429Too Many RequestsRate limit exceeded
500Internal Server ErrorServer-side error

Endpoints Overview

Authentication

EndpointMethodAuthDescription
/api/create-accountPOST-Register new user
/api/log-inPOST-Login with credentials
/api/auth/logoutPOSTYesEnd current session
/api/auth/refresh-tokenPOST-Get new token pair
/api/email-verificationPOST-Verify email with OTP
/api/email-verification/resendPOST-Resend verification code
/api/forgot-passwordPOST-Request password reset
/api/reset-passwordPOST-Set new password

OAuth

EndpointMethodDescription
/api/oauth/githubGETGitHub OAuth callback
/api/oauth/googleGETGoogle OAuth callback

User Management

EndpointMethodAuthDescription
/api/user-detailsGETYesGet user profile
/api/user-detailsPOSTYesUpdate user profile
/api/change-passwordPOSTYesChange or set password
/api/change-usernameGETYesCheck username availability
/api/change-usernamePOSTYesChange username (one-time)
/api/delete-userDELETEYesDelete account
/api/upload-avatarPOSTYesUpload avatar image
/api/upload-avatarDELETEYesRemove avatar

Sessions

EndpointMethodAuthDescription
/api/sessionsGETYesList all sessions
/api/sessionsDELETEYesRevoke a session

Making Requests

Using cURL

# Public endpoint
curl -X POST http://localhost:3000/api/log-in \
  -H "Content-Type: application/json" \
  -d '{"email": "user@example.com", "password": "Pass123!"}'

# Protected endpoint
curl http://localhost:3000/api/user-details \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \
  -H "X-Session-Id: a1b2c3d4-e5f6-7890-abcd-ef1234567890"

Using Fetch

// Public endpoint
const response = await fetch('/api/log-in', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ email, password }),
});

// Protected endpoint
const response = await fetch('/api/user-details', {
  headers: {
    'Authorization': `Bearer ${accessToken}`,
    'X-Session-Id': sessionId,
  },
});

Using the Service Layer

The app includes a pre-configured axios instance with interceptors:

import { authService } from '@/services/auth-service';
import { userService } from '@/services/user-service';

// Auth requests
const result = await authService.login({ email, password });

// User requests (auth headers added automatically)
const profile = await userService.getUserDetails();
await userService.updateUserDetails({ firstName: 'John' });

Error Handling

Prop

Type

Validation Errors

When request validation fails, the response includes details:

{
  "success": false,
  "message": "Validation failed",
  "errors": [
    {
      "field": "email",
      "message": "Invalid email format"
    },
    {
      "field": "password",
      "message": "Must contain at least one uppercase letter"
    }
  ]
}

Rate Limiting

Consider implementing rate limiting for production:

Endpoint TypeSuggested Limit
Login attempts5 per minute
Password reset3 per 15 minutes
Email verification resend3 per 15 minutes
General API100 per minute

On this page