General Guidelines

Authentication

• All endpoints (except /api/v1/setup/* and /api/v1/auth/login) require JWT authentication
• Include token in request header: Authorization: Bearer <token>
• Token expires in 7 days
• Response format for auth success includes token and user object

Rate Limiting

• Global limit: 500 requests per minute
• Per-IP: Applied to all /api/* routes
• Response headers: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset

Error Responses

{
  "error": "Error message",
  "statusCode": 400
}

Pagination

• Default limit: 50 items
• Max limit: 100 items
• Parameters: page, limit, offset
• Response includes: data, total, page, limit

---