Chapter 3 - API and Routes Reference

Scope and model

• TKAMOL does not expose a dedicated REST API (routes/api.php absent); all data exchange is Inertia-centric (server-rendered SPA).
• Most GET api/* endpoints return JSON for pages and are authentication auth + verified routes via web middleware; be aware these endpoints return HTTP errors if called without session.
• There are 535 Route:: call lines in routes/web.php, 46 in routes/settings.php, 16 in routes/auth.php (597 total, ~516 pretty-named in web.php).
• For a full endpoint inventory, inspect the route files. The sections below summarize major groups.

Auth & session endpoints

• Routes in routes/auth.php: register (saas.only), login, forgot/reset password, verify-email, confirm-password, logout.
• Saas rules + middleware / landing.enabled.

Workspace

• Create/list/show/delete/invite/member removal/role updated/impersonation.
• Permissions as part permission:workspace_create, etc.

Projects

• Web CRUD + sub-resources: projects/milestones/*, projects/notes/*, projects/invitations/*, projects/attachments/*.
• Budget records created via projects/{project}/create-budget. Task/Jira? no - Time uses settings by user.

Tasks

• Full CRUD + change-stage, duplicate, complete checklist/attachments/comment endpoints.

Bugs

• Bugs and statuses.

Timesheets

• Daily/weekly/monthly/calendar views + approvals, reports.
• Timer endpoints start/stop/pause/resume/status.

Invoices & billing

• Invoice CRUD.
• Public checkout token endpoints & 33 gateway endpoints.

Admin

• Plans request/order/coupons/companies/users/roles/permissions/language/landing pages/media.
• Settings: profile/email/system/storage/recaptcha/brand/seo/ (with cache clear) + payment + webhook + zoom/slack/telegram.

AJAX & batch email

• /emails/ai-pending, /emails/ai-process, /emails/ai-progress/{batchId}, /emails/ai-cancel/{batchId}, /emails/ai-logs, /emails/ai-logs/{id}. Guarantee only one run on one batch.

Webhooks (inbound)

• Payment callbacks/webhooks: Cashfree, MercadoPago, Benefit, Mollie, Tap, Xendit, PayTR, PayTabs, Skrill, Iyzipay, Easebuzz, ToyyibPay, CoinGate, Ozow, PayFast, FedaPay, Aamarpay, PaymentWall, YooKassa, Nepalste, (partial listed).
• Security note: All webhooks operate outside CSRF by corresponding config exemptions.

Webhooks (outbound)

• Registered from settings/webhooks and fired by WebhookService::triggerWebhooks(module, data, userId).

Error handling & API response data

• Redirects with session errors and page reload; Inertia auto-pass.
• plan.limits middleware returns 402 JSON or redirect when needing subscription; requires user understanding.
• Login errors use plain form responses.

Missing (limitations known)

• Slack get settings, zoom connection test mismatch etc. (see limitation docs).>