# API reference

All calls: `POST api/index.php?r=<route>` with JSON (or multipart for uploads) and header `X-CSRF: <token>` (from `GET api/index.php?r=auth/csrf` or `auth/me`). Downloads (`admin/logs&format=csv`, `admin/bookings/report&format=csv`, `admin/backup`) are plain GET links; `GET api/index.php?r=i18n&lang=fa|en` returns the merged translation table. Responses: `{ok:true,...}` or `{ok:false,error:<key>}`. List endpoints accept `page`, `per_page` and return `total`. Sections switched off in settings answer `feature_off` (403).

| Route | Access |
|---|---|
| `admin/dashboard` | perm: dashboard |
| `admin/users/list` | perm: users |
| `admin/users/detail` | perm: users |
| `admin/users/update` | perm: users |
| `admin/users/messages` | perm: chat |
| `admin/admins/list` | perm: admins (create/update/promote: super_admin) |
| `admin/admins/update` | perm: admins (create/update/promote: super_admin) |
| `admin/admins/promote` | perm: admins (create/update/promote: super_admin) |
| `admin/admins/create` | perm: admins (create/update/promote: super_admin) |
| `admin/services/list` | perm: services |
| `admin/services/save` | perm: services |
| `admin/services/delete` | perm: services |
| `admin/category/save` | perm: services |
| `admin/staff/save` | perm: services |
| `admin/discount/save` | perm: services |
| `admin/discount/delete` | perm: services |
| `admin/bookings/list` | perm: bookings |
| `admin/bookings/status` | perm: bookings |
| `admin/bookings/create` | perm: bookings |
| `admin/block/date` | perm: bookings |
| `admin/block/slot` | perm: bookings |
| `admin/block/delete` | perm: bookings |
| `admin/settings/get` | perm: settings |
| `admin/settings/save` | perm: settings |
| `admin/logs` | perm: logs |
| `admin/notify` | perm: content |
| `admin/reports` | perm: content |
| `admin/chat/staff` | perm: chat |
| `admin/staff/delete` | perm: services |
| `admin/category/delete` | perm: services |
| `admin/reviews/list` | perm: services |
| `admin/reviews/delete` | perm: services |
| `auth/register` | public (session/* need login) |
| `auth/login` | public (session/* need login) |
| `auth/logout` | public (session/* need login) |
| `auth/me` | public (session/* need login) |
| `auth/verify` | public (session/* need login) |
| `auth/resend_verify` | public (session/* need login) |
| `phone/send` | logged-in user |
| `phone/verify` | logged-in user |
| `auth/forgot` | public (session/* need login) |
| `auth/reset` | public (session/* need login) |
| `profile/update` | logged-in user |
| `profile/avatar` | logged-in user |
| `profile/password` | logged-in user |
| `site/info` | public (session/* need login) |
| `session/list` | logged-in user |
| `session/revoke` | logged-in user |
| `session/revoke_others` | logged-in user |
| `services/list` | logged-in user |
| `booking/slots` | logged-in user |
| `booking/create` | logged-in user |
| `booking/mine` | logged-in user |
| `booking/cancel` | logged-in user |
| `booking/reschedule` | logged-in user |
| `admin/bookings/reschedule` | perm: bookings |
| `booking/history` | booking owner or perm: bookings |
| `review/add` | logged-in user |
| `service/fav` | logged-in user |
| `chat/messages` | logged-in user |
| `chat/send` | logged-in user |
| `chat/poll` | logged-in user |
| `chat/typing` | logged-in user |
| `chat/read` | logged-in user |
| `chat/react` | logged-in user |
| `chat/delete` | logged-in user |
| `chat/search` | logged-in user |
| `admin/chat/list` | perm: chat |
| `admin/chat/update` | perm: chat |
| `notif/list` | logged-in user |
| `notif/read` | logged-in user |
| `notif/prefs` | logged-in user |
| `feed/list` | logged-in user |
| `feed/post` | logged-in user |
| `post/view` | logged-in user |
| `post/like` | logged-in user |
| `post/save` | logged-in user |
| `post/share` | logged-in user |
| `post/report` | logged-in user |
| `comment/list` | logged-in user |
| `comment/add` | logged-in user |
| `comment/like` | logged-in user |
| `story/list` | logged-in user |
| `story/view` | logged-in user |
| `story/like` | logged-in user |
| `story/reply` | logged-in user |
| `admin/story/create` | perm: content |
| `admin/story/delete` | perm: content |
| `admin/story/list` | perm: content |
| `admin/story/stats` | perm: content |
| `admin/post/save` | perm: content |
| `admin/post/delete` | perm: content |
| `admin/post/list` | perm: content |
| `admin/comment/list` | perm: content |
| `admin/comment/act` | perm: content |
| `follow/toggle` | logged-in user |
| `feed/categories` | logged-in user |
| `admin/pcat/list` | perm: content |
| `admin/pcat/save` | perm: content |
| `admin/pcat/delete` | perm: content |
| `admin/post/get` | perm: content |
| `admin/report/act` | perm: content |
| `post/fav` | logged-in user |
| `poll/vote` | logged-in user |
| `admin/poll/create` | perm: chat |
| `poll/voters` | logged-in user |
| `poll/create_group` | logged-in user |
| `ws/token` | logged-in user |
| `review/list` | logged-in user |
| `notif/prefs_get` | logged-in user |
| `admin/backup` | super_admin |
| `i18n` | public (session/* need login) |
| `admin/translations/list` | perm: translations |
| `admin/translations/save` | perm: translations |
| `admin/media/list` | perm: media |
| `admin/media/delete` | perm: media |
| `admin/media/cleanup` | perm: media |
| `admin/media/upload` | perm: media |
| `admin/bookings/report` | perm: bookings |
| `user/search` | logged-in user |
| `group/create` | logged-in user |
| `group/list` | logged-in user |
| `group/info` | logged-in user |
| `group/add` | logged-in user |
| `group/remove` | logged-in user |
| `group/update` | logged-in user |