API Reference

Solvory API v1 — REST + JSON, Bearer-token auth via Laravel Sanctum.

Base URL

https://your-domain.com/api/v1

Authentication

Every authenticated request must include an Authorization: Bearer <token> header. Get a token by POSTing to /auth/login. Tokens issued by /auth/login have no expiry; impersonation tokens issued by admins expire in 30 minutes.

curl -H "Authorization: Bearer YOUR_TOKEN" \
     https://your-domain.com/api/v1/auth/me

On the menu

Auth

POST/auth/register

Body: { name, email, password, password_confirmation }. Returns { token, user }. Sends a verification email.

POST/auth/login

Body: { email, password }. Returns { token, user }. Throttled at 5 attempts/min.

GET/auth/me

Returns the authenticated user.

POST/auth/logout

Revokes the current token.

POST/auth/change-password

Body: { current_password, password, password_confirmation }. Revokes all other sessions on success.

Debts

GET/debts

Paginated list. Filters: status, type_id, currency_code, archived, per_page.

POST/debts

Required: type_id, currency_code, amount, direction, counterpart_name. Direction is owed_by_me or owed_to_me.

GET/debts/{id}

Single debt with payments and settlement proposals.

PUT/debts/{id}

Update any field except the id.

DELETE/debts/{id}

Soft-delete. Reversible for 30 days.

POST/debts/{id}/archive

Hide without deleting.

GET/debts/export

CSV download of every debt for the user. UTF-8 + BOM.

Payments

POST/debts/{id}/payments

Body: { amount, currency_code?, paid_at?, method?, notes? }. Method: cash | transfer | gift | written_off | mutual_agreement | other. Status flips to paid when remaining balance reaches zero.

Settlements

POST/debts/{id}/settlement

Propose a partial settlement. Body: { proposed_amount, message? }.

Attachments

GET/debts/{id}/attachments

List attachments (receipts, screenshots, IOUs). Each item has a public url.

POST/debts/{id}/attachments

Multipart with file field. Max 10 MB, types: jpg, png, webp, heic, pdf. Limit 10 per debt.

DELETE/debts/{id}/attachments/{attachment_id}

Removes the file from disk and the row from the DB.

Notifications

GET/notifications

Recent in-app notifications, newest first. Includes unread count.

POST/notifications/read-all

Mark every unread notification as read.

Reports

POST/reports

Body: { target_type, target_id, category, description? }. Limited to 10 per user per day.

Sync (mobile offline-first)

POST/sync/push

Upload local mutations. Body: array of { entity, op, payload, client_updated_at }. Server applies last-write-wins.

GET/sync/pull

Query: since (ISO 8601). Returns rows changed after that timestamp.

Reference data

GET/languages

Active locales. Public — no auth required.

GET/languages/{code}/ui-strings

Full UI translation map for a locale. Cached aggressively.

GET/currencies

Supported currencies with codes and symbols. Public.

GET/debt-types

Built-in debt categories (food, rent, loan, etc.). Public.

Errors

All errors return JSON: { "message": "..." }. Validation errors include an errors object with field-keyed arrays. Standard codes:

401 — missing or invalid token
403 — authenticated but not allowed (wrong owner, not admin)
404 — resource not found
422 — validation failed
429 — rate-limited

Need help?

Try the FAQ or drop us a line.