# E-Fatorah API documentation

Machine-readable discovery:

- OpenAPI: [/openapi.json](/openapi.json)
- API catalog: [/.well-known/api-catalog](/.well-known/api-catalog)
- OAuth protected resource: [/.well-known/oauth-protected-resource](/.well-known/oauth-protected-resource)
- Authorization server metadata: [/.well-known/oauth-authorization-server](/.well-known/oauth-authorization-server)
- Agent auth guide: [/auth.md](/auth.md)
- Health: [/up](/up)

## Authentication

Admin APIs require a Sanctum bearer token from `POST /api/auth/login`.

```http
POST /api/auth/login
Content-Type: application/json

{"email":"admin@example.com","password":"secret","remember":false}
```

Use the returned `token` as `Authorization: Bearer {token}` on subsequent requests.

## Primary surfaces

| Surface | Base path | Notes |
|---------|-----------|-------|
| Auth | `/api/auth/*` | Login, OTP reset, session |
| Admin CMS | `/api/admin/*` | Requires Sanctum + permissions |
| Health | `/up` | Laravel health check |
| MCP | `/mcp` | Read-only site tools for agents |

See `/auth.md` for agent registration guidance.