System — users, payments, settings#
The largest module by resource count.
Every resource offers the standard set of actions
get, get-by, get-all, save, update-columns, delete, delete-all —
unless stated otherwise. See the CRUD pattern.
Users#
| Resource | Note |
|---|---|
auth |
authentication actions — see Authentication |
user |
user — owner |
user-role, user-group, user-type |
classification |
user-discount-level |
discount level |
user-payment |
membership |
user-role-privilege |
⛔ no HTTP actions |
blacklist, blacklisted-word |
blocking |
login-provider |
sign-in via an outside service |
The user resource has extra actions#
| Action | What it does |
|---|---|
public-profile |
the public profile |
show-phone |
reveals the phone — rate limited |
send-activation-email |
resends activation |
send-new-password |
e-mails a link to set a new password — strict limit |
reset-password |
sets the new password from the link; email, key and password only in the POST body |
generate-new-password |
generates a new password — administrator only |
update-password |
changes the password — owner, requires the current password; only in the POST body, see Authentication |
show-phone allows 20 calls an hour from one address
It is protection against bulk contact harvesting.
Writing an account#
user/save by a non-privileged caller (guest, owner) is refused:
| Case | code |
errorCode |
|---|---|---|
the account type requires a company ID and company name, or a VAT ID, and it is missing — checked only when the write carries the account type (userTypeId) |
2 |
userTypeDataMissing |
| a new account with an e-mail or phone on the blacklist | 615 |
blacklisted |
| an account edit that changes the e-mail or phone to a blacklisted value | 615 |
blacklisted |
Missing fields are only in the message
data carries only errorCode. Which fields are missing (regId, companyName,
vatId) is stated in the message text. An unchanged e-mail or phone that was blacklisted
later does not prevent saving the rest of the account.
Blacklist and forbidden words#
blacklist holds blocked e-mails, phones and IP addresses (type 1 = IP, 2 = e-mail,
3 = phone). An IP address may also be a CIDR range (IPv4 and IPv6). E-mail is compared
case-insensitively, phone by digits only (prefix 00 = +).
The blacklist guards writes by a non-privileged caller for new records: comments, newsletter
subscribers, adverts and company profiles, replies to them, saved searches, contact messages,
discussion posts, complaints, orders, reservations and new accounts (for an account edit, only
a changed e-mail or phone). Refusal: code: 615, data.errorCode: blacklisted. The
administrator is not checked.
blacklisted-word is the single forbidden-word list for the whole site — adverts, the
company directory and the discussion share it; there are no per-module lists. Words have
translations per language and the check uses the active words of the request page language.
Content and structure#
| Resource | Note |
|---|---|
page |
page — tree, public, action homepage |
menu, menu-item |
menus — tree, public |
route |
routing |
admin-page, admin-menu-item |
administration structure |
image |
image |
file-system |
⛔ no HTTP actions |
Code lists — public reading#
language, localization, currency, vat, unit, region (tree),
tariff.
Fetch code lists once and cache them
They change rarely. Calling them on every request is wasteful.
Settings#
| Action | What it returns |
|---|---|
get-public-merged |
public settings |
get-merged |
everything — for authorised callers only |
Do not reach for get-merged without permission
It returns values that are not meant to leave the system.
Payments#
| Resource | Note |
|---|---|
payment |
payment, plus create, execute, delivery |
payment-gate, payment-gate-phone |
gateways |
payment-region |
payment regions — public |
payment-status |
statuses |
payment-callback |
post-payment handler |
payment-transaction |
transactions — read-only |
payment-error-log |
errors |
The express-execute action receives SMS messages from the aggregator
The payment SMS aggregator calls it with the gateway secret and it answers in plain text
per the aggregator's specification. It is not meant for integrations. The express payment
offer (express-offers) is composed only by the website and has no HTTP wrapper.
Gateway return addresses return plain text, not JSON
They are meant for a browser, not for your client.
E-mail and notifications#
email, email-queue, smtp-setting, notification, notification-type,
pdf-template, pdf-template-layout, privilege-group.
notification carries the receiver in the field receiverUserId
null means a notification shared by all administrators. The field used to be called
userId; the old name no longer applies. The entity knows whom it belongs to, so the
role receiver can be wired to notifications.
Third-party connections#
The resource external-connection (/api/system/external-connection) holds connections to
outside services — reCAPTCHA, Google Analytics, Tag Manager, Search Console, Maps. A row has
a type, an enabled switch and a config, an object with the values (keys, IDs).
Administrator only — config holds secret keys
No reading is public, not even for a signed-in user. Do not store the response or log it.
A connection is not created through the API
A new connection type comes by installation (code plus a database row). Through the API
only enabled and config of already installed rows change.
The outgoing mail settings hold credentials
The password is not returned. Do not try to read it.