1. Authentication

1.1 Check Setup Status

GET /api/v1/setup/status

Check if initial setup is required.

Response:

{
  "setupRequired": true,
  "organizationCount": 0
}

---

1.2 Initial Setup

POST /api/v1/setup

Create organization and owner user account. Only available when system has no organizations.

Request Body:

{
  "orgName": "Acme Corporation",
  "fullName": "John Doe",
  "email": "[email protected]",
  "password": "SecurePassword123"
}

Response:

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "user": {
    "id": "user-123",
    "email": "[email protected]",
    "fullName": "John Doe",
    "role": "owner",
    "orgId": "org-123"
  }
}

Status Codes: 201, 400, 409 (if setup already done)

---

1.3 Login

POST /api/v1/auth/login

Authenticate user and receive JWT token.

Request Body:

{
  "email": "[email protected]",
  "password": "SecurePassword123"
}

Response:

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "user": {
    "id": "user-123",
    "email": "[email protected]",
    "fullName": "John Doe",
    "role": "admin",
    "orgId": "org-123"
  }
}

Status Codes: 200, 401 (invalid credentials)

---

1.4 Get Current Profile

GET /api/v1/profile

Get authenticated user's profile.

Headers:

Authorization: Bearer <token>

Response:

{
  "id": "user-123",
  "email": "[email protected]",
  "fullName": "John Doe",
  "role": "admin",
  "orgId": "org-123",
  "department": "Sales",
  "avatar": "https://...",
  "createdAt": "2026-01-15T10:30:00Z",
  "lastLogin": "2026-06-05T14:22:00Z"
}

Status Codes: 200, 401

---