LogiLoop API

Complete REST API reference for the UK logistics backhauling platform.

API Version 1.0 All endpoints return JSON. Dates use ISO 8601 format. UUIDs are used for all resource identifiers.

Base URL

https://your-domain.com/api

All endpoints are prefixed with /api. Health check is available at /api/health.

Security Features

LogiLoop implements multiple layers of security to protect your data and operations.

🔐 JWT Authentication

HS256-signed tokens. 24-hour access tokens, 30-day refresh tokens. Stateless session management.

🛡️ Role-Based Access Control

Fine-grained RBAC with 10+ roles. Method-level security via Spring Security @PreAuthorize.

🔑 Multi-Factor Authentication

TOTP-based MFA enrolment available for all user accounts. Adds a second verification layer.

🔒 BCrypt Password Hashing

All passwords hashed with BCrypt (strength 10). Plaintext passwords are never stored.

⏱️ Rate Limiting

Bucket4j-based rate limiting on billing endpoints. Per-company limits prevent abuse.

🏢 Multi-Tenant Isolation

Company-segregated data at query level. Users can only access their own organisation's data.

🌐 CORS Protection

Configured for specific allowed origins. Preflight OPTIONS requests handled automatically.

📋 Full Audit Trail

Every action logged with user, timestamp, IP, and outcome. Tamper-evident audit logs.

Enterprise API Keys Dedicated API key authentication for WMS/TMS integration is on the roadmap. Currently, all API access uses JWT bearer tokens.

Authentication

All protected endpoints require a JWT bearer token in the Authorization header.

Auth Flow

1. POST /api/auth/login        → receive accessToken + refreshToken
2. Use accessToken in header:   Authorization: Bearer <accessToken>
3. When expired, call:           POST /api/auth/refresh
4. To end session:               POST /api/auth/logout

Public Endpoints (No Auth Required)

PatternDescription
/api/auth/**Login, register, refresh tokens
/api/platform/auth/**Platform admin authentication
/api/healthHealth check
/api/public/**Public pages (email verification, approvals)
/api/mfa/enroll/**MFA enrolment
/api/photos/**Photo serving
/api/webhooks/**Stripe webhook callbacks
/actuator/**Spring Boot actuator

Auth Endpoints