# BizzCab API

One set of docs and one Postman folder. Do not keep a second copy elsewhere.

Local base URL: `http://127.0.0.1:5001/api` (set by `PORT` in `Backend/.env`).

| App | Docs | Postman |
|---|---|---|
| Shared | this file | [BizzCab Local](postman/BizzCab.postman_environment.json) |
| User | [user-app-api.md](user-app-api.md) | [User App](postman/BizzCab-User-App.postman_collection.json) |
| Driver | [driver-app-api.md](driver-app-api.md) | [Driver App](postman/BizzCab-Driver-App.postman_collection.json) |
| Admin | [admin-api.md](admin-api.md) | [Admin](postman/BizzCab-Admin.postman_collection.json) |

Import the environment, then the collection for the app you are testing. Run **Send OTP** / **Login** first so the collection tests store the token.

Regenerate the JSON with `npm run postman` in `Backend`. That writes only `Backend/docs/postman`.

## Envelope

```json
{ "success": true, "message": "…", "data": {} }
```

Errors:

```json
{ "success": false, "message": "Ride not found", "data": null }
```

## Auth

Send `Authorization: Bearer <token>` on every route that is not listed as public.

| Who | How the token is issued |
|---|---|
| User login | `POST /user/auth/verify-otp` after `POST /user/auth/send-otp` (existing number only) |
| User signup | `POST /user/auth/register` after register send-otp and verify-otp |
| Driver login | `POST /driver/auth/verify-otp` after `POST /driver/auth/send-otp` (existing number only) |
| Driver signup | `POST /driver/auth/register`, then `/driver/onboarding/vehicle` and `/driver/onboarding/bank` |
| Admin | `POST /admin/auth/login` (then `POST /admin/auth/verify-otp` if 2FA is on) |

OTP is 4 digits. In development, without MSG91, `send-otp` returns `data.devOtp`.

Seeded logins (after `npm run seed`):

- User phone `9000000001` (Aarav Sharma)
- Driver phone `8000000006` (Rahul Sharma)
- Admin `admin@bizzcab.com` / `Admin@123`

## Public routes

No token.

| Method | Path |
|---|---|
| GET | `/health` |
| GET | `/public/app-config` |
| GET | `/public/cms` |
| GET | `/public/cms/:slug` |
| GET | `/public/vehicle-types` |
| GET | `/public/cities` |
| GET | `/public/rides/share/:token` |
| POST | `/public/payments/webhook` |

`GET /health` is mounted at `/api/health`. With the Postman `baseUrl` that already includes `/api`, the request path is `/health`.

Uploads are served from `/uploads/...` on the API origin, not under `/api`.