XcodeSol Security Guard Admin Documentation

API

The application exposes a JSON REST API authenticated via Laravel Sanctum bearer tokens (for admin users) or device tokens (for biometric devices).

Authentication

Admin Login

text
POST /api/auth/login

Request body:

json
{
  "email": "admin@example.com",
  "password": "your-password"
}

Response:

json
{
  "token": "sanctum-token-here",
  "user": { "id": 1, "name": "Admin", "email": "admin@example.com" }
}

All subsequent admin requests must include the token in the Authorization header:

text
Authorization: Bearer <sanctum-token>

Device Authentication

Devices authenticate via the device_token field in the request body (no HTTP header required). See Devices and Biometrics.

Admin Routes

All admin routes are protected by auth:sanctum middleware.

Current User

text
GET /api/auth/user
POST /api/auth/logout

Guards

text
GET    /api/guards
POST   /api/guards
GET    /api/guards/{id}
PUT    /api/guards/{id}
DELETE /api/guards/{id}

Locations

text
GET    /api/locations
POST   /api/locations
GET    /api/locations/{id}
PUT    /api/locations/{id}
DELETE /api/locations/{id}

Clients

text
GET    /api/clients
POST   /api/clients
GET    /api/clients/{id}
PUT    /api/clients/{id}
DELETE /api/clients/{id}

Attendance

text
GET    /api/attendances
POST   /api/attendances
GET    /api/attendances/{id}
PUT    /api/attendances/{id}
DELETE /api/attendances/{id}
POST   /api/attendances/bulk-date       → { date, marks: { guardId: status, ... } }
POST   /api/attendances/bulk-range      → { from, to, status }

Payments

text
GET    /api/payments
POST   /api/payments
GET    /api/payments/{id}
PUT    /api/payments/{id}
DELETE /api/payments/{id}

Weapons, Uniforms, Advances

text
GET    /api/weapons
POST   /api/weapons
GET    /api/weapons/{id}
PUT    /api/weapons/{id}
DELETE /api/weapons/{id}

GET    /api/uniforms
POST   /api/uniforms
GET    /api/uniforms/{id}
PUT    /api/uniforms/{id}
DELETE /api/uniforms/{id}

GET    /api/advances
POST   /api/advances
GET    /api/advances/{id}
PUT    /api/advances/{id}
DELETE /api/advances/{id}

Devices

text
GET    /api/devices
POST   /api/devices
GET    /api/devices/{id}
PUT    /api/devices/{id}
DELETE /api/devices/{id}
POST   /api/devices/attendance                  → device check-in/out (no auth header, uses device_token)
POST   /api/devices/{device}/regenerate-token   → revoke and generate new API token

Guard Biometrics

text
GET    /api/guard-biometrics
POST   /api/guard-biometrics
GET    /api/guard-biometrics/{id}
PUT    /api/guard-biometrics/{id}
DELETE /api/guard-biometrics/{id}

Settings

text
GET    /api/settings
POST   /api/settings
PUT    /api/settings/{id}
GET    /api/settings/attendance-mode
PUT    /api/settings/attendance-mode

Reports

text
GET /api/reports/{type}   → ?month=1&year=2026

Type: attendance, salary

Salary

text
GET /api/salary   → ?month=1&year=2026

Device Attendance Endpoint

This endpoint does not require a Sanctum bearer token. Devices authenticate via the device_token body field.

text
POST /api/devices/attendance

| Field | Type | Description | |---|---|---| | device_token | string | API token of the registered device (required). | | biometric_type | string | fingerprint, face, or nfc (required). | | identifier | string | The biometric identifier enrolled for the guard (required). | | type | string | check_in or check_out (required). | | timestamp | datetime | Optional. Defaults to server time if omitted. |

NextAttendance