Laravel Matcha E-commerce API
The Laravel Matcha API provides endpoints for managing products, orders, and user authentication for an e-commerce application. All API requests are made to the base URL:
https://matcha-backend-testing.belirbx.com/api
The API uses JSON for request and response payloads and follows RESTful conventions.
The API uses Laravel Sanctum for authentication. Include the Bearer token in the Authorization header.
/api/login
Authenticate user and get access token
{
"email": "user@example.com",
"password": "password"
}{
"success": true,
"message": "Login successful",
"data": {
"user": {
"id": 1,
"name": "John Doe",
"email": "user@example.com",
"roles": ["admin"]
},
"token": "1|abc123..."
}
}/api/logout
Revoke current access token
Requires: Authorization header with Bearer token
/api/me
Get authenticated user information
Requires: Authorization header with Bearer token
Note: All product endpoints require authentication. Include the Bearer token in the Authorization header.
/api/products
Get list of active products with pagination and filtering
Requires: Authorization header with Bearer token
Authorization: Bearer {token}
Content-Type: application/jsonsearch - Search by product namemin_price - Minimum price filtermax_price - Maximum price filtersort_by - Sort field (default: created_at)sort_order - Sort direction (asc/desc)per_page - Items per page (default: 15){
"success": true,
"data": {
"products": [
{
"id": 1,
"name": "Laptop Gaming",
"description": "High-performance gaming laptop",
"image": "laptop.jpg",
"price": "15000000.00",
"stock": 10,
"is_active": true,
"created_at": "2025-10-17T06:30:00.000000Z"
}
],
"pagination": {
"current_page": 1,
"last_page": 1,
"per_page": 15,
"total": 5
}
}
}/api/products/{id}
Get detailed information about a specific product
Requires: Authorization header with Bearer token
Authorization: Bearer {token}
Content-Type: application/jsonNote: All order endpoints require authentication. Include the Bearer token in the Authorization header.
/api/orders
Create a new order with multiple products
Requires: Authorization header with Bearer token
{
"items": [
{
"product_id": 1,
"quantity": 2
},
{
"product_id": 2,
"quantity": 1
}
],
"notes": "Please deliver quickly",
"payment_method": "qris"
}BNC QRIS: Payment reference is returned by BNC as:
partner_reference_no
Example: ABC2604091805123456. Cash uses a CASH-UUID reference.
{
"success": true,
"message": "Order created successfully",
"data": {
"order": {
"id": 1,
"order_number": "ORD-ABC123",
"total_amount": "38000000.00",
"status": "pending",
"payment_method": "qris",
"payment_reference": "ABC2604091805123456",
"paid_at": null,
"items": [
{
"id": 1,
"order_id": 1,
"product_id": 1,
"quantity": 2,
"price": "15000000.00",
"total": "30000000.00",
"product": {
"id": 1,
"name": "Laptop Gaming",
"description": "High-performance gaming laptop"
}
}
],
"created_at": "2025-10-17T06:30:00.000000Z"
}
}
}/api/orders
Get all orders for authenticated user
Requires: Authorization header with Bearer token
/api/orders/{identifier}
Get detailed information about a specific order
Requires: Authorization header with Bearer token
Identifier can be order_number or payment_reference
/api/orders/{identifier}/status
Requires edit orders permission. Status updates do not confirm payment. Success and delivered require payment; cancelling an unpaid order restores stock once.
Requires: Authorization header with Bearer token
{
"status": "success",
"notes": "Payment confirmed and order completed"
}pending - Order is waiting for processingprocessing - Order is being preparedshipped - Order has been shippeddelivered - Order has been deliveredcancelled - Order has been cancelledsuccess - Order paid (requires confirmed payment){
"success": true,
"message": "Order status updated successfully",
"data": {
"order": {
"id": 1,
"order_number": "ORD-ABC123",
"status": "success",
"paid_at": "2025-10-17T16:34:12.000000Z",
"notes": "Payment confirmed and order completed",
"order_items": [...]
}
}
}/api/orders/{identifier}/success
Confirm received cash payment. Admin/ops with edit orders permission only. QRIS is confirmed by BNC webhook.
Requires: Authorization header with Bearer token
Only active cash orders can be confirmed. Changing payment method never marks an order paid.
{
"success": true,
"message": "Cash payment confirmed",
"data": {
"order": {
"id": 1,
"order_number": "ORD-ABC123",
"status": "success",
"paid_at": "2025-10-17T16:34:12.000000Z",
"order_items": [...]
}
}
}qriscashpayment_method is required and must be either qris or cashpayment_reference is assigned by the serverpaid_at is null until payment is confirmedPOST /api/webhooks/bnc with X-Bnc-Notify-Token or X-Api-Key, matching BNC_QRIS_WEBHOOK_TOKEN. Only event=bnc.qris.notify, trx_type=PAYMENT, and latest_transaction_status=00 confirm payment. The server matches original_partner_reference_no, the exact amount, and IDR currency. Replays preserve payment time and fulfilment status.
The public manual/external and Xendit callbacks have been removed. Unknown references return 404; late payments for cancelled orders or orders already paid by another method return 409 and require reconciliation.
{
"message": "The given data was invalid.",
"errors": {
"email": ["The email field is required."],
"password": ["The password field is required."]
}
}{
"message": "Unauthenticated."
}{
"success": false,
"message": "Product not found"
}{
"success": false,
"message": "Failed to create order: Database connection error"
}