System

Base URL

Every path below is relative to https://api.laksonoteknologi.com/v2.

Applies to every endpoint on this page

Accept-Language header (or ?lang= query param, which wins if both are sent) picks the response/error locale - optional, falls back to the server's configured default if neither is sent.
Successful responses are {"response_code":"001", "response_text":"Success", "data": {...}}.

POST/v2/system/menu-itemscommand

Creates a new sidebar menu item node - either a root node (omit parent_id) or a child of an existing node (parent_id must point to an existing menu item, checked server-side). code must be kebab-case and globally unique across the whole tree, not just among siblings. required_obj/required_act gate visibility: if set, the item only shows up in get-menu for callers who hold that permission; the two fields must be supplied together (setting one without the other is rejected). system_owner only.

Auth required · system_ownermenu:create

Headers

Authorization: Bearer <token>
Content-Type: application/json
Accept-Language: en (optional - defaults to server config, or use ?lang= instead)

Requires "command": "create-menu-item" in the request body.

Request fields

Field	Source	Type	Required	Validation
`data.parent_id`	body	string	false	omitempty
`data.code`	body	string	true	required,kebabcase
`data.label`	body	string	true	required
`data.icon`	body	string	false	omitempty
`data.route`	body	string	false	omitempty
`data.required_obj`	body	string	true	omitempty,required_with=RequiredAct
`data.required_act`	body	string	true	omitempty,required_with=RequiredObj
`data.sort_order`	body	integer	false	omitempty
`data.is_active`	body	boolean	false	-

Example

Create Merchant

POST/v2/system/merchantscommand

Creates a new merchant profile (name/email/phone/address/company_registration_number) together with its mandatory super_admin account (email/password/name/phone) in a single transaction - a merchant can never exist without a super_admin. system_owner only; a merchant token is rejected at the auth layer before this handler is even reached, and the usecase separately re-checks the caller's parent_role, since is_root alone can't tell 'root everywhere' apart from 'root only within my own merchant domain'.

Auth required · system_ownermerchant:create

Headers

Authorization: Bearer <token>
Content-Type: application/json
Accept-Language: en (optional - defaults to server config, or use ?lang= instead)

Requires "command": "create-merchant" in the request body.

Request fields

Field	Source	Type	Required	Validation
`data.name`	body	string	true	required
`data.email`	body	string	false	omitempty,email
`data.phone`	body	string	false	omitempty
`data.address`	body	string	false	omitempty
`data.company_registration_number`	body	string	false	omitempty
`data.admin`	body	object	false	-
`data.admin.email`	body	string	true	required,email
`data.admin.password`	body	string	true	required,min=8
`data.admin.name`	body	string	true	required
`data.admin.phone`	body	string	false	omitempty

Example

DELETE/v2/system/menu-items/:idcommand

Soft-deactivates a menu item by id (is_active becomes false) - the row and any children stay in the DB, it just stops being returned by get-menu for FE sidebars. Not a hard delete, so it can be reactivated later via update-menu-item. system_owner only.

Auth required · system_ownermenu:delete

Headers

Authorization: Bearer <token>
Content-Type: application/json
Accept-Language: en (optional - defaults to server config, or use ?lang= instead)

Requires "command": "deactivate-menu-item" in the request body.

Request fields

Field	Source	Type	Required	Validation
`:id`	path	string	true	required

Example

PUT/v2/system/menu-items/:idcommand

Updates an existing menu item's label/icon/route/parent_id/permission gate (required_obj+required_act)/sort_order/is_active. code is set once at creation and is immutable here - it's not part of this request body at all. Re-parenting via parent_id is allowed and re-validated (the new parent must exist). system_owner only.

Auth required · system_ownermenu:update

Headers

Authorization: Bearer <token>
Content-Type: application/json
Accept-Language: en (optional - defaults to server config, or use ?lang= instead)

Requires "command": "update-menu-item" in the request body.

Request fields

Field	Source	Type	Required	Validation
`:id`	path	string	true	required
`data.parent_id`	body	string	false	omitempty
`data.label`	body	string	true	required
`data.icon`	body	string	false	omitempty
`data.route`	body	string	false	omitempty
`data.required_obj`	body	string	true	omitempty,required_with=RequiredAct
`data.required_act`	body	string	true	omitempty,required_with=RequiredObj
`data.sort_order`	body	integer	false	omitempty
`data.is_active`	body	boolean	false	-

Example

Roles

Create Sub Role

POST/v2/system/roles/sub-rolescommand

Creates a custom sub-role (code + display name) under one of the fixed parent roles (system_owner/merchant/customer/device_player). code must be kebab-case and unique within that parent_role. The new sub-role starts with no permissions attached - grant them separately via grant-role-permission.

Auth required · system_ownerrole:create

Headers

Authorization: Bearer <token>
Content-Type: application/json
Accept-Language: en (optional - defaults to server config, or use ?lang= instead)

Requires "command": "create-sub-role" in the request body.

Request fields

Field	Source	Type	Required	Validation
`data.parent_role`	body	string	true	required,oneof=system_owner merchant customer device_player
`data.code`	body	string	true	required,kebabcase
`data.name`	body	string	true	required

Example

Deactivate Sub Role

DELETE/v2/system/roles/sub-roles/:idcommand

Soft-deactivates a sub-role by id (is_active becomes false) - the row and its permission grants are kept, it just stops being assignable/usable going forward. Rejects the seeded, protected codes (super_admin/device_admin) outright; only custom sub-roles can be deactivated.

Auth required · system_ownerrole:delete

Headers

Authorization: Bearer <token>
Content-Type: application/json
Accept-Language: en (optional - defaults to server config, or use ?lang= instead)

Requires "command": "deactivate-sub-role" in the request body.

Request fields

Field	Source	Type	Required	Validation
`:id`	path	string	true	required

Example

Get Parent Roles

GET/v2/system/roles/parent-rolesquery

Lists the fixed set of parent roles seeded at setup time (system_owner/merchant/customer/device_player) - these are not user-creatable or editable, this endpoint exists purely so FE can populate a parent_role dropdown (e.g. when creating a sub-role) without hardcoding the list client-side.

Auth required · system_ownerrole:readNo body / params

Headers

Authorization: Bearer <token>
Accept-Language: en (optional - defaults to server config, or use ?lang= instead)

Plain query parameters - no request body / command field needed.

Example

Get Sub Roles

GET/v2/system/roles/sub-rolesquery

Lists sub-roles (super_admin/device_admin and any custom ones created via create-sub-role), each flagged with is_root/is_active/protected. Optionally filter to just one parent_role's sub-roles via the query param; omit it to get all sub-roles across every parent_role.

Auth required · system_ownerrole:read

Headers

Authorization: Bearer <token>
Accept-Language: en (optional - defaults to server config, or use ?lang= instead)

Plain query parameters - no request body / command field needed.

Request fields

Field	Source	Type	Required	Validation
`parent_role`	query	string	false	omitempty,oneof=system_owner merchant customer device_player

Example

Update Sub Role

PUT/v2/system/roles/sub-roles/:idcommand

Renames a sub-role's display name (name only - code is immutable and not part of this request). Rejects the seeded, protected codes (super_admin/device_admin) outright; only custom sub-roles created via create-sub-role can be renamed.

Auth required · system_ownerrole:update

Headers

Authorization: Bearer <token>
Content-Type: application/json
Accept-Language: en (optional - defaults to server config, or use ?lang= instead)

Requires "command": "update-sub-role" in the request body.

Request fields

Field	Source	Type	Required	Validation
`:id`	path	string	true	required
`data.name`	body	string	true	required

Example

Permissions

Customer

Password

Groups

Middlewares

:file_id

Policies

Uploads

Menu Items

Roles

System

Create Menu Item

Create Merchant

Menu Items

Deactivate Menu Item

Update Menu Item

Roles

Create Sub Role

Deactivate Sub Role

Get Parent Roles

Get Sub Roles

Update Sub Role

System ​

Create Menu Item ​

Create Merchant ​

Menu Items ​

Deactivate Menu Item ​

Update Menu Item ​

Roles ​

Create Sub Role ​

Deactivate Sub Role ​

Get Parent Roles ​

Get Sub Roles ​

Update Sub Role ​

System

Create Menu Item

Create Merchant

Menu Items

Deactivate Menu Item

Update Menu Item

Roles

Create Sub Role

Deactivate Sub Role

Get Parent Roles

Get Sub Roles

Update Sub Role