Auth

Base URL

Every path below is relative to https://api.laksonoteknologi.com/v2.

Applies to every endpoint on this page

• Accept-Language header (or ?lang= query param, which wins if both are sent) picks the response/error locale - optional, falls back to the server's configured default if neither is sent.
• Successful responses are {"response_code":"001", "response_text":"Success", "data": {...}}.

Unified Login

POST/v2/auth/logincommand

Single login endpoint for system_owner, merchant, and customer accounts (email/password) - the provider isn't sent by the client, it's resolved server-side by trying each provider's secret in turn until one verifies. Response bundles the access/refresh token pair, the user's own profile summary (parent_role/sub_role/is_root/merchant_id), and the caller's full effective permissions list in one shot, so FE never needs a follow-up call just to render the initial dashboard.

Public

Headers

Content-Type: application/json
Accept-Language: en (optional - defaults to server config, or use ?lang= instead)

Requires "command": "unified-login" in the request body.

Request fields

Field	Source	Type	Required	Validation
data.email	body	string	true	required,email
data.password	body	string	true	required

Example

---

Unified Logout

POST/v2/auth/logoutcommand

Revokes the caller's own current access token immediately (no request body needed) - the token stops working right away, even before its exp would naturally expire. Works for any authenticated human actor (system_owner/merchant/customer), not scoped to one provider.

Auth required · any (system_owner, merchant, or customer)No body / params

Headers

Authorization: Bearer <token>
Content-Type: application/json
Accept-Language: en (optional - defaults to server config, or use ?lang= instead)

---

Unified Refresh

POST/v2/auth/refreshcommand

Exchanges a still-valid refresh_token for a brand-new access/refresh token pair, rotating the old refresh token out (single-use, not reusable after this call). Which provider issued the token is read from the token itself, not sent by the client - works the same for system_owner/merchant/customer without the caller needing to track which kind of account it is.

Public

Headers

Content-Type: application/json
Accept-Language: en (optional - defaults to server config, or use ?lang= instead)

Requires "command": "unified-refresh" in the request body.

Request fields

Field	Source	Type	Required	Validation
data.refresh_token	body	string	true	required

Example

---

Customer

Google Redirect

GET/v2/auth/customer/googlequery

Returns the Google OAuth consent screen URL to redirect the browser to, as the first step of Google sign-in for customer accounts - FE navigates the user there, Google then redirects back to this app's OAuth callback with an auth code to complete the login. Customer-facing only; system_owner/merchant/device_player don't have a Google login path.

Public

Headers

Accept-Language: en (optional - defaults to server config, or use ?lang= instead)

Plain query parameters - no request body / command field needed.

Request fields

Field	Source	Type	Required	Validation
redirect	query	string	false	omitempty

Example

---

Guest Login

POST/v2/auth/customer/guestcommand

Starts a customer session with no email/password/registration at all - no request body needed. The session is 'sliding': every authenticated request made with this token can silently extend it further (watch for X-Refreshed-Token/X-Refreshed-Refresh-Token response headers and swap to them), so a genuinely idle guest is the only one who ever actually expires. Call guest-upgrade later to convert this into a real, permanent customer account without losing whatever the guest already did.

PublicNo body / params

Headers

Content-Type: application/json
Accept-Language: en (optional - defaults to server config, or use ?lang= instead)

---

Guest Upgrade

POST/v2/auth/customer/guest/upgradecommand

Converts the CALLER's own currently-authenticated guest session (Bearer token from guest-login) into a permanent, password-protected customer account, in place - same account identity, now with real credentials instead of an anonymous sliding session. Requires an active guest token; a non-guest customer or a logged-out caller can't call this.

Auth required · customer

Headers

Authorization: Bearer <token>
Content-Type: application/json
Accept-Language: en (optional - defaults to server config, or use ?lang= instead)

Requires "command": "guest-upgrade" in the request body.

Request fields

Field	Source	Type	Required	Validation
data.email	body	string	true	required,email
data.password	body	string	true	required,min=8
data.password_confirmation	body	string	true	required,eqfield=Password

Example

---

Register Customer

POST/v2/auth/customer/registercommand

Self-service customer sign-up - deliberately only 4 fields (name/email/password/password_confirmation), no company info. customer_type defaults to 'individual'; a business customer fills in company details later via the profile-update endpoint rather than at registration. Public, no auth required. Does not log the new account in automatically - call unified-login afterwards.

Public

Headers

Content-Type: application/json
Accept-Language: en (optional - defaults to server config, or use ?lang= instead)

Requires "command": "register-customer" in the request body.

Request fields

Field	Source	Type	Required	Validation
data.name	body	string	true	required
data.email	body	string	true	required,email
data.password	body	string	true	required,min=8
data.password_confirmation	body	string	true	required,eqfield=Password

Example

---

Resend Verification

POST/v2/auth/customer/verify-email/resendcommand

Re-sends the verification email to the CALLER's own address (no request body needed) - for when the original registration email was lost, expired (24h TTL), or never arrived. Fails with a conflict if the account is already verified.

Auth required · customerNo body / params

Headers

Authorization: Bearer <token>
Content-Type: application/json
Accept-Language: en (optional - defaults to server config, or use ?lang= instead)

---

Verify Email

POST/v2/auth/customer/verify-emailcommand

Consumes the token from a verification email link (FE reads ?token= off /auth/verify-email and POSTs it here) - sets the caller's account as verified. Public, no auth required, since the customer isn't necessarily logged in when they click the link.

Public

Headers

Content-Type: application/json
Accept-Language: en (optional - defaults to server config, or use ?lang= instead)

Requires "command": "verify-email" in the request body.

Request fields

Field	Source	Type	Required	Validation
data.token	body	string	true	required

Example

---

Password

Forgot Password

POST/v2/auth/password/forgotcommand

Requests a password reset for the given email - currently a stub: the reset token is logged server-side, not actually emailed, until mailer infrastructure is wired up. Always responds the same way regardless of whether the email exists, to avoid leaking which addresses are registered.

Public

Headers

Content-Type: application/json
Accept-Language: en (optional - defaults to server config, or use ?lang= instead)

Requires "command": "forgot-password" in the request body.

Request fields

Field	Source	Type	Required	Validation
data.email	body	string	true	required,email

Example

---

Reset Password

POST/v2/auth/password/resetcommand

Consumes the single-use token issued by forgot-password (sent via the emailed/logged reset link) together with a new_password, and sets that as the account's password - the token is invalidated after this call whether it succeeds or the password fails validation. Public, no auth required, since the caller isn't logged in at this point.

Public

Headers

Content-Type: application/json
Accept-Language: en (optional - defaults to server config, or use ?lang= instead)

Requires "command": "reset-password" in the request body.

Request fields

Field	Source	Type	Required	Validation
data.token	body	string	true	required
data.password	body	string	true	required,min=8
data.password_confirmation	body	string	true	required,eqfield=Password

Example

---