API conventions¶
FastAPI mounts the current API under /api/v1. The local base URL is:
http://localhost:8000/api/v1
Interactive OpenAPI documentation is available at /docs.
Authentication¶
Use the internal eAkto session:
Authorization: Bearer EAKTO_SESSION_TOKEN
Do not pass eGovPH, eVerify, eGovAI, or Supabase credentials to eAkto endpoints.
Content types¶
| Content | Type |
|---|---|
| Ordinary requests | application/json |
| Vault and extraction uploads | multipart/form-data |
| Ordinary responses | application/json |
Access levels¶
| Level | Meaning |
|---|---|
| Public | No existing eAkto session is required |
| Authenticated | Valid, unexpired eAkto session |
| High assurance | Authenticated plus current DOCUMENT_VAULT_ACCESS assurance |
| Development only | Endpoint behavior is restricted by APP_ENV |
| Prototype internal | Not safe for public exposure until authentication/ownership guards are added |
Mounted endpoint groups¶
Cache behavior¶
Journey collections, document catalog responses, and vault lists set:
Cache-Control: private, no-store
Clients should not persist high-assurance document responses in shared caches.
Identifier format¶
Internal users, sessions, challenges, intents, journeys, milestones, assurances, and documents use opaque identifiers. Treat them as strings; do not derive meaning or authorization from their format.
Source of truth¶
This reference includes only routes mounted in backend/app/main.py. Older Flutter repository methods referencing /cases, /notifications, /dev/scenarios, and similar demo endpoints are not part of the current mounted API.