Admin & ops
All routes under /api/v1/admin require a staff Sanctum token.
Spatie permissions further restrict each group.
Core surfaces
Dashboard & leads
GET /admin/dashboard, leads list/show/update, activity log.
WhatsApp inbox
Conversations, messages, and quick replies under /admin/inbox.
Analytics
Overview, traffic, products, leads funnel, WhatsApp metrics.
Settings
Grouped settings, email/WhatsApp tests, setup checklist, exports.
Users & roles
GET|POST /api/v1/admin/users
GET|PATCH /api/v1/admin/users/{id}
GET /api/v1/admin/roles
PUT /api/v1/admin/roles/{role}
Media
GET|POST /api/v1/admin/media
PATCH|DELETE /api/v1/admin/media/{id}
Exports
GET /api/v1/admin/exports/{type} where type is one of content, catalog, orders, media, settings, full.
Webhooks for Razorpay and WhatsApp are registered outside
/api/v1 and are intentionally
omitted from the public OpenAPI surface. Configure secrets in Admin → Settings.