System — users, payments, settings#
The largest module by resource count.
Every resource offers the standard set of actions
get, get-by, get-all, save, update-columns, delete, delete-all —
unless stated otherwise. See the CRUD pattern.
Users#
| Resource | Note |
|---|---|
auth |
authentication actions — see Authentication |
user |
user — owner |
user-role, user-group, user-type |
classification |
user-discount-level |
discount level |
user-payment |
membership |
user-role-privilege |
⛔ no HTTP actions |
blacklist, blacklisted-word |
blocking |
login-provider |
sign-in via an outside service |
The user resource has extra actions#
| Action | What it does |
|---|---|
public-profile |
the public profile |
show-phone |
reveals the phone — rate limited |
send-activation-email |
resends activation |
send-new-password |
sends a new password — strict limit |
generate-new-password |
generates one |
update-password |
changes the password — owner |
show-phone allows 20 calls an hour from one address
It is protection against bulk contact harvesting.
Content and structure#
| Resource | Note |
|---|---|
page |
page — tree, public, action homepage |
menu, menu-item |
menus — tree, public |
route |
routing |
admin-page, admin-menu-item |
administration structure |
image |
image |
file-system |
⛔ no HTTP actions |
Code lists — public reading#
language, localization, currency, vat, unit, region (tree),
tariff.
Fetch code lists once and cache them
They change rarely. Calling them on every request is wasteful.
Settings#
| Action | What it returns |
|---|---|
get-public-merged |
public settings |
get-merged |
everything — for authorised callers only |
Do not reach for get-merged without permission
It returns values that are not meant to leave the system.
Payments#
| Resource | Note |
|---|---|
payment |
payment, plus create, execute, delivery |
payment-gate, payment-gate-phone |
gateways |
payment-region |
payment regions — public |
payment-status |
statuses |
payment-callback |
post-payment handler |
payment-transaction |
transactions — read-only |
payment-error-log |
errors |
The express-execute action is a stub
It returns a failure with status 204 and an empty body. Do not rely on it.
Gateway return addresses return plain text, not JSON
They are meant for a browser, not for your client.
E-mail and notifications#
email, email-queue, smtp-setting, notification, notification-type,
pdf-template, pdf-template-layout, privilege-group.
The outgoing mail settings hold credentials
The password is not returned. Do not try to read it.