api-endpoints

To document REST API endpoints for web SPA and mobile clients, consolidate routes and authentication guards into a single source of truth like readme/API.md. This ensures consistent integration by defining clear response contracts and dual-auth mechanisms.

Dual authentication with session cookies and Sanctum tokens works by enforcing both auth mechanisms across your API routes. This design allows web SPAs to authenticate via session cookies while mobile clients use Sanctum tokens for secure access.

The current API version source of truth for v3 endpoint groups is readme/API.md. It consolidates the v3 routes and public endpoints defined in routes/api.php, ensuring all frontend and mobile integrations reference the correct API contracts.

To maintain API route contracts when modifying routes in routes/api.php, consult readme/API.md to understand current contracts before making changes. This ensures the v3 endpoint group and authentication guards remain consistently documented for all clients.

Yes, this API documentation approach supports public endpoints and authentication guards. It consolidates the comprehensive endpoint catalog including v3 routes, applying dual-auth aware design with session cookies and Sanctum tokens for secure access control.

Keeping API endpoint documentation in a single source of truth prevents contract drift between backend routes and frontend clients. It provides a unified reference for endpoints, auth guards, and response contracts, enabling consistent maintenance and integration.