Developers
API and integrations
The app API
Base address https://your-domain/api/v1; JSON in and out; errors follow RFC 7807 (application/problem+json). The interactive description is at /api/doc.
Signing in
| Endpoint | Purpose |
|---|---|
POST /users | Create an account (a confirmation email is sent). |
POST /users/login | Email and password; returns an access token and a refresh token. |
POST /users/token/refresh | New tokens from a refresh token (single use). |
POST /users/forgot-password, POST /users/reset-password | Password reset by email. |
POST /users/confirmation | Confirm the email address. |
Send the access token as Authorization: Bearer <token>.
Catalogue and search (no sign-in needed)
| Endpoint | Purpose |
|---|---|
GET /platform | Name, language, currency and other settings the app needs. |
GET /home | Featured categories, promoted and newest listings; recently viewed and recommended when signed in. |
GET /categories, GET /categories/{id}/attributes | The category tree and each category's attributes. |
GET /regions, GET /locations | Regions and locality search (query, region). |
GET /listings | Search: q, category, region, location, radius, price_min, price_max, price_type, condition, a[code], sort, page. |
GET /listings/{id} | One listing. |
GET /sellers/{id}, GET /sellers/{id}/reviews | Seller page. |
GET /search/suggestions | Suggestions while typing. |
Signed in
| Area | Endpoints |
|---|---|
| Account | GET/PATCH /users/me, avatar, email, password, phone verification, data export, DELETE /users/me |
| Listings | POST /listings, PATCH /listings/{id}, photos (POST /listings/images), renew, deactivate, reserve, statistics, DELETE, favourites, report, phone reveal, GET /users/me/listings |
| Messages | GET/POST /conversations, messages, archive, delete, review the seller; POST /pusher/auth to receive new messages live on private-user.{id} (event message.new; key and cluster in GET /platform under realtime) |
| Offers | POST /listings/{id}/offers, `POST /offers/{id}/accept |
| Saved searches | GET/POST /users/me/saved-searches, PATCH, DELETE |
| Notifications | list, mark as read, settings per type and channel |
| Push | POST /devices registers an Expo push token, DELETE /devices removes it |
GET /health answers 200 when the database, the queue and the storage are fine, 503 otherwise.
External services
| Service | Used for | Configured in |
|---|---|---|
| Email provider (Mailgun, SES, Postmark, SMTP...) | Every email | MAILER_DSN |
| Expo | Push notifications to the app | EXPO_DSN |
| Pusher Channels | Optional. New messages without reloading, on the website and in the app (Settings, Chat). | |
| Twilio or Vonage | Phone verification codes | Admin, Settings, SMS |
| S3-compatible storage, CDN | Photos | Admin, Settings, Storage |
| GeoNames | Regions and localities | php bin/console app:geo:import CC |
| "Continue with Facebook" | FB_ID, FB_SECRET | |
| Google Analytics, Facebook Pixel, AdSense | Statistics and ads, after cookie consent | Admin, Settings, Platform |
| Sentry | Error reports | SENTRY_DSN |
Found a mistake? Tell us.