{ "info": { "_postman_id": "8f3e2b10-6c91-4d92-bf31-b6e82847a920", "name": "WhiteLabel Core PHP Backend APIs", "description": "Complete Postman collection for WhiteLabel Core PHP Backend.\nIncludes Role-based Authentication, Admin 3rd-party balance, User local DB balance, Sub-user provisioning, Wallet recharges, 3rd-party services catalog & execution with custom headers, atomic deductions, and separate Admin/User reports.\n\nAll timestamps use IST (Asia/Kolkata) integer His format (e.g. 112345).", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json" }, "variable": [ { "key": "baseUrl", "value": "http://localhost/whiteLableBackend", "type": "string" }, { "key": "admin_token", "value": "", "type": "string" }, { "key": "user_token", "value": "", "type": "string" } ], "item": [ { "name": "1. Authentication", "item": [ { "name": "Vendor Signup / Register (Role 3)", "event": [ { "listen": "test", "script": { "exec": [ "var jsonData = pm.response.json();", "if (jsonData.success && jsonData.data && jsonData.data.token) {", " pm.collectionVariables.set('user_token', jsonData.data.token);", " console.log('Saved vendor token successfully:', jsonData.data.token);", "}" ], "type": "text/javascript" } } ], "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"name\": \"Vendor Alpha Services\",\n \"email\": \"vendor@example.com\",\n \"password\": \"vendor123\",\n \"balance\": 0.00\n}" }, "url": { "raw": "{{baseUrl}}/api/register", "host": [ "{{baseUrl}}" ], "path": [ "api", "register" ] }, "description": "Public registration endpoint for Vendors. Automatically assigns role = 3 directly in backend function. Returns user profile, terms status, and auth JWT token." }, "response": [] }, { "name": "Login Step 1: Request OTP (Credentials Check)", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"email\": \"admin@example.com\",\n \"password\": \"admin123\"\n}" }, "url": { "raw": "{{baseUrl}}/api/login", "host": [ "{{baseUrl}}" ], "path": [ "api", "login" ] }, "description": "Step 1 of OTP login. Validates credentials, generates a 6-digit OTP, stores it in `otps` table with 5-minute expiry, and returns otp_required: true." }, "response": [] }, { "name": "Login Step 2: Verify OTP (Admin 3rd-Party Balance via cURL)", "event": [ { "listen": "test", "script": { "exec": [ "var jsonData = pm.response.json();", "if (jsonData.success && jsonData.data && jsonData.data.token) {", " pm.collectionVariables.set('admin_token', jsonData.data.token);", " console.log('Saved admin_token successfully:', jsonData.data.token);", "}" ], "type": "text/javascript" } } ], "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"email\": \"admin@example.com\",\n \"otp\": \"123456\"\n}" }, "url": { "raw": "{{baseUrl}}/api/verify_otp", "host": [ "{{baseUrl}}" ], "path": [ "api", "verify_otp" ] }, "description": "Step 2 of OTP login. Validates OTP code, marks it used, fetches live Admin balance from Upper Provider via cURL (or local DB for sub-users), issues JWT token, and returns user profile." }, "response": [] }, { "name": "Resend OTP", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"email\": \"admin@example.com\"\n}" }, "url": { "raw": "{{baseUrl}}/api/resend_otp", "host": [ "{{baseUrl}}" ], "path": [ "api", "resend_otp" ] }, "description": "Invalidates previous OTP and generates a fresh 6-digit OTP code." }, "response": [] }, { "name": "Get Profile (Live 3rd-Party Balance via cURL)", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{admin_token}}" } ], "url": { "raw": "{{baseUrl}}/api/profile", "host": [ "{{baseUrl}}" ], "path": [ "api", "profile" ] }, "description": "Fetches profile. For Admin (role 1), queries Upper Provider via cURL to fetch fresh live balance and displays it in profile." }, "response": [] }, { "name": "User Login Step 1: Request OTP via Email", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"email\": \"user@example.com\",\n \"password\": \"user123\"\n}" }, "url": { "raw": "{{baseUrl}}/api/login", "host": [ "{{baseUrl}}" ], "path": [ "api", "login" ] }, "description": "Step 1: Sub-user submits credentials. Generates 6-digit OTP and sends it to the sub-user's email address via EmailService." }, "response": [] }, { "name": "User Login Step 2: Verify OTP (Local DB Balance)", "event": [ { "listen": "test", "script": { "exec": [ "var jsonData = pm.response.json();", "if (jsonData.success && jsonData.data && jsonData.data.token) {", " pm.collectionVariables.set('user_token', jsonData.data.token);", " console.log('Saved user_token successfully:', jsonData.data.token);", "}" ], "type": "text/javascript" } } ], "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"email\": \"user@example.com\",\n \"otp\": \"123456\"\n}" }, "url": { "raw": "{{baseUrl}}/api/verify_otp", "host": [ "{{baseUrl}}" ], "path": [ "api", "verify_otp" ] }, "description": "Step 2: Sub-user enters OTP received on email. Validates OTP, returns role 2, local DB balance, and saves {{user_token}}." }, "response": [] } ] }, { "name": "2. Sub-User Management", "item": [ { "name": "Create Sub-User (Admin Only)", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Authorization", "value": "Bearer {{admin_token}}" } ], "body": { "mode": "raw", "raw": "{\n \"name\": \"Sarah Connor\",\n \"email\": \"sarah.sub@example.com\",\n \"password\": \"password123\",\n \"balance\": 250.00\n}" }, "url": { "raw": "{{baseUrl}}/api/create_sub_user", "host": [ "{{baseUrl}}" ], "path": [ "api", "create_sub_user" ] }, "description": "Creates a new sub-user in the local database. Strictly enforces parent_id = logged-in Admin's ID and role = 2." }, "response": [] }, { "name": "List All Sub-Users of Admin", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{admin_token}}" } ], "url": { "raw": "{{baseUrl}}/api/sub_users", "host": [ "{{baseUrl}}" ], "path": [ "api", "sub_users" ] }, "description": "Lists all sub-users created under the authenticated Admin (WHERE parent_id = admin.id)." }, "response": [] } ] }, { "name": "3. Wallet & Balance Recharges", "item": [ { "name": "Admin Recharges Sub-User Balance (Local DB)", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Authorization", "value": "Bearer {{admin_token}}" } ], "body": { "mode": "raw", "raw": "{\n \"user_id\": 2,\n \"amount\": 150.00,\n \"notes\": \"Monthly wallet top-up from Admin\"\n}" }, "url": { "raw": "{{baseUrl}}/api/add_balance", "host": [ "{{baseUrl}}" ], "path": [ "api", "add_balance" ] }, "description": "Admin adds balance to a sub-user. Updates `users.balance`, logs in `recharges` and `transactions` tables, and returns updated sub-user current balance, total expend, and recharges summary." }, "response": [] }, { "name": "List Sub-Users Recharges with Current Balance & Total Expend", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{admin_token}}" } ], "url": { "raw": "{{baseUrl}}/api/add_balance", "host": [ "{{baseUrl}}" ], "path": [ "api", "add_balance" ] }, "description": "Retrieves list of all sub-users under this Admin along with their current balance, total expend (spent on services), total recharged, and individual recharge history." }, "response": [] }, { "name": "Admin Requests Wallet Recharge from Upper Provider", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Authorization", "value": "Bearer {{admin_token}}" } ], "body": { "mode": "raw", "raw": "{\n \"amount\": 5000.00,\n \"is_gst\": 18,\n \"notes\": \"NEFT ref #99281726 to Upper Provider\"\n}" }, "url": { "raw": "{{baseUrl}}/api/admin_credit_request", "host": [ "{{baseUrl}}" ], "path": [ "api", "admin_credit_request" ] }, "description": "Admin requests balance recharge from Upper Provider. Forwards via cURL to https://panel.aulakh.in/corp_panel/?request=add_new_credit_request_by_corp and records in local `admin_credit_requests` table." }, "response": [] }, { "name": "List Admin Credit Requests to Upper Provider", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{admin_token}}" } ], "url": { "raw": "{{baseUrl}}/api/admin_credit_request", "host": [ "{{baseUrl}}" ], "path": [ "api", "admin_credit_request" ] }, "description": "Lists all credit recharge requests submitted by the Admin to the Upper Provider." }, "response": [] } ] }, { "name": "4. Third-Party Services & Assignment", "item": [ { "name": "Get Available Services (3rd-Party cURL)", "request": { "method": "GET", "header": [], "url": { "raw": "{{baseUrl}}/api/services", "host": [ "{{baseUrl}}" ], "path": [ "api", "services" ] }, "description": "Queries the Third-Party API via cURL to retrieve available service catalog (PAN verification, Aadhaar, Bank verify, GST, etc.)." }, "response": [] }, { "name": "Admin Assigns Service with Selling Price", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Authorization", "value": "Bearer {{admin_token}}" } ], "body": { "mode": "raw", "raw": "{\n \"user_id\": 2,\n \"service_id\": \"SRV_PAN_VERIFY\",\n \"service_name\": \"PAN Card Verification API\",\n \"price\": 5.00\n}" }, "url": { "raw": "{{baseUrl}}/api/assign_service", "host": [ "{{baseUrl}}" ], "path": [ "api", "assign_service" ] }, "description": "Admin assigns a service to a sub-user and configures the selling price charged per hit." }, "response": [] } ] }, { "name": "5. Service Execution & Deductions", "item": [ { "name": "Submit / Execute Service (Sub-User)", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Authorization", "value": "Bearer {{user_token}}" } ], "body": { "mode": "raw", "raw": "{\n \"service_id\": \"SRV_PAN_VERIFY\",\n \"request_data\": {\n \"pan_number\": \"ABCDE1234F\",\n \"name\": \"John Doe\"\n },\n \"custom_headers\": {\n \"X-Partner-Id\": \"PARTNER-9912\",\n \"X-Request-Source\": \"Postman-Test\"\n }\n}" }, "url": { "raw": "{{baseUrl}}/api/submit_service", "host": [ "{{baseUrl}}" ], "path": [ "api", "submit_service" ] }, "description": "1. Checks user balance in DB BEFORE calling 3rd-party (halts with 400 if insufficient).\n2. Sends cURL to 3rd-party with custom headers.\n3. Atomically deducts assigned price from user balance.\n4. Logs in transactions (SERVICE_DEBIT) and service_logs." }, "response": [] }, { "name": "Custom Create Service Request (Upper Provider Direct / Admin & Sub-User)", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Authorization", "value": "Bearer {{admin_token}}" } ], "body": { "mode": "raw", "raw": "{\n \"request\": \"custom_create_service_request\",\n \"server_data\": \"\",\n \"service_uuid\": \"e116125c-84e9-4539-aa81-6f6403fd3029\",\n \"payload\": {\n \"cust_fname\": \"Subhash\",\n \"cust_mname\": \"\",\n \"cust_lname\": \"Subhash\",\n \"cust_pan\": \"KNLPS1528H\",\n \"cust_phone\": \"\",\n \"cust_dob\": \"01012000\",\n \"cust_gender\": \"MALE\",\n \"cust_email\": \"\",\n \"cust_rline1\": \"\",\n \"cust_rline2\": \"\",\n \"cust_rcity\": \"\",\n \"cust_rstate\": \"\",\n \"cust_rzip\": \"\",\n \"cust_pline1\": \"\",\n \"cust_pline2\": \"\",\n \"cust_pcity\": \"\",\n \"cust_pstate\": \"\",\n \"cust_pzip\": \"\"\n },\n \"api_public_key\": \"pk_7894384cc1c28be4dc3cca77dd0464abfd06247568863125457d2be850fff375\",\n \"api_secret_key\": \"sk_b25c74729f91ed14a4af3a8552aadb37016d147545f58613161abddf07477236b1a7ee22230c8c0ac2be2ab3e3e70784128924550dadca3b3c8ff2c68a1ce863\"\n}" }, "url": { "raw": "{{baseUrl}}/api/custom_create_service_request", "host": [ "{{baseUrl}}" ], "path": [ "api", "custom_create_service_request" ] }, "description": "Exact custom_create_service_request endpoint for Frontend. Forwards request, server_data, service_uuid, payload, and keys directly to Upper Provider via cURL and records execution in database." }, "response": [] } ] }, { "name": "6. Transactions & Reports (Dual Functions)", "item": [ { "name": "Admin Organization Report & Transactions", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{admin_token}}" } ], "url": { "raw": "{{baseUrl}}/api/reports?scope=admin", "host": [ "{{baseUrl}}" ], "path": [ "api", "reports" ], "query": [ { "key": "scope", "value": "admin" } ] }, "description": "Calls getAdminTransactionsAndReports(). Returns organization-wide report: total transactions, total recharge volume, total service usage volume, active sub-users count, service breakdown, and all sub-user transactions." }, "response": [] }, { "name": "User Personal Report & Transactions", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{user_token}}" } ], "url": { "raw": "{{baseUrl}}/api/reports?scope=user", "host": [ "{{baseUrl}}" ], "path": [ "api", "reports" ], "query": [ { "key": "scope", "value": "user" } ] }, "description": "Calls getUserTransactionsAndReports(). Returns personal report strictly for the logged-in User: current balance, total balance received, total balance spent, total services called, recent service logs, and personal transactions only." }, "response": [] } ] }, { "name": "6. Sub-User Wallet Recharge & GST Invoices", "item": [ { "name": "Gateway: 1. Create Order (Razorpay)", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Authorization", "value": "Bearer {{user_token}}" } ], "body": { "mode": "raw", "raw": "{\n \"amount\": 1000.00\n}" }, "url": { "raw": "{{baseUrl}}/api/wallet/gateway/create-order", "host": [ "{{baseUrl}}" ], "path": [ "api", "wallet", "gateway", "create-order" ] }, "description": "Sub-user initiates online recharge. Calculates 18% GST (Taxable: ₹847.46, GST: ₹152.54), creates Razorpay order, records PENDING request." }, "response": [] }, { "name": "Gateway: 2. Verify Payment & Credit Wallet", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Authorization", "value": "Bearer {{user_token}}" } ], "body": { "mode": "raw", "raw": "{\n \"razorpay_order_id\": \"order_xxx\",\n \"razorpay_payment_id\": \"pay_xxx\",\n \"razorpay_signature\": \"xxx\"\n}" }, "url": { "raw": "{{baseUrl}}/api/wallet/gateway/verify-payment", "host": [ "{{baseUrl}}" ], "path": [ "api", "wallet", "gateway", "verify-payment" ] }, "description": "Verifies HMAC SHA-256 signature, prevents duplicate payment replay, atomically increments wallet_balance, sets status SUCCESS, and generates GST Tax Invoice." }, "response": [] }, { "name": "Manual: 1. Submit Recharge Request (UTR + Slip)", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{user_token}}" } ], "body": { "mode": "formdata", "formdata": [ { "key": "amount", "value": "5000.00", "type": "text" }, { "key": "utr_number", "value": "982736451234", "type": "text" }, { "key": "is_gst_already_deducted", "value": "0", "type": "text" }, { "key": "notes", "value": "HDFC Bank IMPS Transfer", "type": "text" }, { "key": "proof_file", "type": "file", "src": [] } ] }, "url": { "raw": "{{baseUrl}}/api/wallet/manual-request", "host": [ "{{baseUrl}}" ], "path": [ "api", "wallet", "manual-request" ] }, "description": "Sub-user submits manual bank payment proof. Validates unique UTR to prevent fraud, uploads receipt file, sets status PENDING." }, "response": [] }, { "name": "Manual: 2. My Recharge History", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{user_token}}" } ], "url": { "raw": "{{baseUrl}}/api/wallet/my-requests?status=PENDING&page=1&limit=20", "host": [ "{{baseUrl}}" ], "path": [ "api", "wallet", "my-requests" ], "query": [ { "key": "status", "value": "PENDING" }, { "key": "page", "value": "1" }, { "key": "limit", "value": "20" } ] }, "description": "Sub-user retrieves past/pending manual and gateway recharge requests with live statuses, UTR, proof link, and invoice URL." }, "response": [] }, { "name": "Admin: 1. List Manual Requests (Pending Approval Queue)", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{admin_token}}" } ], "url": { "raw": "{{baseUrl}}/api/admin/manual-requests?status=PENDING&page=1&limit=20", "host": [ "{{baseUrl}}" ], "path": [ "api", "admin", "manual-requests" ], "query": [ { "key": "status", "value": "PENDING" }, { "key": "page", "value": "1" }, { "key": "limit", "value": "20" } ] }, "description": "Admin lists sub-users' recharge requests. Filterable by status (PENDING, APPROVED, REJECTED, SUCCESS), sub-user id, and pagination." }, "response": [] }, { "name": "Admin: 2. Approve Request (with 18% GST Logic)", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Authorization", "value": "Bearer {{admin_token}}" } ], "body": { "mode": "raw", "raw": "{\n \"deduct_gst\": true,\n \"admin_note\": \"Payment verified from bank statement\"\n}" }, "url": { "raw": "{{baseUrl}}/api/admin/manual-requests/1/approve", "host": [ "{{baseUrl}}" ], "path": [ "api", "admin", "manual-requests", "1", "approve" ] }, "description": "Admin approves manual recharge. If deduct_gst=true: deducts 18% GST (Net = Amount - Amount*18/118). If false: credits 100% full amount. Executes ACID transaction to increment wallet_balance and generates GST Tax Invoice." }, "response": [] }, { "name": "Admin: 3. Reject Request", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Authorization", "value": "Bearer {{admin_token}}" } ], "body": { "mode": "raw", "raw": "{\n \"reason\": \"Invalid UTR / Payment not received in bank account\"\n}" }, "url": { "raw": "{{baseUrl}}/api/admin/manual-requests/1/reject", "host": [ "{{baseUrl}}" ], "path": [ "api", "admin", "manual-requests", "1", "reject" ] }, "description": "Admin rejects request with mandatory reason. Marks status REJECTED with zero wallet modification." }, "response": [] }, { "name": "Download GST Tax Invoice (PDF Stream)", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{user_token}}" } ], "url": { "raw": "{{baseUrl}}/api/wallet/invoice/INV-20260930-00001", "host": [ "{{baseUrl}}" ], "path": [ "api", "wallet", "invoice", "INV-20260930-00001" ] }, "description": "Generates pure-PHP PDF Tax Invoice. Includes Company GSTIN, Sub-user details, SAC Code 9984, Base Taxable Value, CGST 9%, SGST 9%, Total Amount, and Net Credited Amount. Query params: ?format=html for printable preview, ?format=json for raw data." }, "response": [] } ] }, { "name": "7. Terms & Conditions (T/C) System", "item": [ { "name": "Sub-User: 1. Get Current Terms & Acceptance Status", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{user_token}}" } ], "url": { "raw": "{{baseUrl}}/api/terms/current", "host": [ "{{baseUrl}}" ], "path": [ "api", "terms", "current" ] }, "description": "Returns current active Terms & Conditions with full content and whether the authenticated sub-user has accepted this version." }, "response": [] }, { "name": "Sub-User: 2. Accept Terms & Conditions", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Authorization", "value": "Bearer {{user_token}}" } ], "body": { "mode": "raw", "raw": "{\n \"terms_id\": 1\n}" }, "url": { "raw": "{{baseUrl}}/api/terms/accept", "host": [ "{{baseUrl}}" ], "path": [ "api", "terms", "accept" ] }, "description": "Sub-user accepts current active Terms & Conditions. Records acceptance timestamp, IP address, and browser user-agent. Unlocks full platform access." }, "response": [] }, { "name": "Admin: 1. List All Terms Versions & Stats", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{admin_token}}" } ], "url": { "raw": "{{baseUrl}}/api/admin/terms", "host": [ "{{baseUrl}}" ], "path": [ "api", "admin", "terms" ] }, "description": "Admin retrieves all authored T/C versions with active status flag and sub-user acceptance counts (accepted_count vs pending_count)." }, "response": [] }, { "name": "Admin: 2. Publish New Terms Version", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Authorization", "value": "Bearer {{admin_token}}" } ], "body": { "mode": "raw", "raw": "{\n \"version\": \"v1.1\",\n \"title\": \"Updated Terms of Service & API Acceptable Use Policy 2026\",\n \"content\": \"

Updated Terms of Service

By using this platform, you agree to updated regulatory and wallet guidelines.

\",\n \"is_active\": true\n}" }, "url": { "raw": "{{baseUrl}}/api/admin/terms", "host": [ "{{baseUrl}}" ], "path": [ "api", "admin", "terms" ] }, "description": "Admin publishes a new version of Terms & Conditions. Setting is_active: true automatically deactivates previous versions and requires ALL sub-users to accept this new version before accessing anything except their profile." }, "response": [] }, { "name": "Admin: 3. View Sub-Users Acceptance Status Report", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{admin_token}}" } ], "url": { "raw": "{{baseUrl}}/api/admin/terms/sub-users-status", "host": [ "{{baseUrl}}" ], "path": [ "api", "admin", "terms", "sub-users-status" ] }, "description": "Admin compliance audit: lists all sub-users and whether each user has accepted the latest active version or is still pending acceptance." }, "response": [] }, { "name": "Admin: 4. Activate Existing Terms Version", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Authorization", "value": "Bearer {{admin_token}}" } ], "body": { "mode": "raw", "raw": "{\n \"terms_id\": 1\n}" }, "url": { "raw": "{{baseUrl}}/api/admin/terms/activate", "host": [ "{{baseUrl}}" ], "path": [ "api", "admin", "terms", "activate" ] }, "description": "Sets an existing terms version as active and deactivates others." }, "response": [] } ] } ] }