Appearance

Download as .md

Quickstart ​

Written by Rohman Beny Riyanto

The shortest path from "never touched this API" to "made an authenticated call and got real data back." Every step below can be done two ways: copy-pasting the curl command, or clicking through the same request in this site's own Try It panel (the button on each endpoint's API Reference page) - both hit the exact same server, so pick whichever is faster for you.

1. Get an account ​

If you already have credentials, skip to step 2. Otherwise, register a customer account:

bash
curl -X POST 'https://api.laksonoteknologi.com/v2/customer/register' \
  -H 'Content-Type: application/json' \
  -d '{
    "command": "register-customer",
    "data": {
      "name": "Jane Doe",
      "email": "jane@example.com",
      "password": "at-least-8-chars",
      "password_confirmation": "at-least-8-chars"
    }
  }'

This does not log you in automatically - registration and login are separate steps on purpose (see Unified Login's own description). Move on to step 2 with the same email/password.

2. Log in and get a token ​

bash
curl -X POST 'https://api.laksonoteknologi.com/v2/auth/login' \
  -H 'Content-Type: application/json' \
  -d '{
    "command": "unified-login",
    "data": { "email": "jane@example.com", "password": "at-least-8-chars" }
  }'

The response bundles everything a typical app needs on first load in one call:

json
{
  "response_code": "001",
  "response_text": "Success",
  "data": {
    "access_token": "eyJ...",
    "refresh_token": "eyJ...",
    "expires_in": 3600,
    "user": { "id": "...", "parent_role": "customer", "sub_role": null, "is_root": false, "merchant_id": null },
    "permissions": ["..."]
  }
}

Same endpoint works for system_owner, merchant, and customer accounts - you never send which kind of account you're logging in as, the server figures it out from the email.

3. Call an authenticated endpoint ​

Every endpoint tagged Auth required on the API Reference pages needs access_token from step 2 as a Bearer token:

bash
curl 'https://api.laksonoteknologi.com/v2/admin/permissions/catalog' \
  -H 'Authorization: Bearer eyJ...'

access_token expires after expires_in seconds (see the response above). When it does, don't send the user back to login - exchange the refresh_token for a new pair first (see FE Auth Error Handling for exactly which response code means "expired, go refresh" vs. "actually logged out, go to login").

Where to go next ​

  • FE Auth Error Handling - the 4 distinct ways an authenticated call can fail, and what to do for each.
  • Rate Limiting - what happens past 100 requests/minute and how to back off.
  • Validation Errors - the shape of a rejected request and how it differs from an auth error.
  • Export to Postman - skip typing curl commands entirely; download every endpoint as a ready-to-run Postman collection.
  • Request/Response Pattern - why every request body looks like {"command"/"query": "...", "data": {...}}, and how auth/permission checks are ordered.