# Products API

This document describes the internal products APIs.

## Authentication

Both APIs require the static token configured in `.env`:

```env
PRODUCT_ACTION_API_TOKEN=your_static_token_here
```

Send the same token using one of these options:

```bash
Authorization: Bearer your_static_token_here
```

```bash
X-API-Token: your_static_token_here
```

Or pass `api_token` in the request body/query string.

All product APIs are fixed to:

```text
app_id = 1011
```

Any `app_id` sent in insert or update requests is ignored.

## Get Products

Endpoint:

```text
GET /admin/api/products
```

Returns active products where `is_active = 1` and `app_id = 1011`.

Optional query parameter:

- `limit`: number of records to return. Default is `100`, maximum is `500`.

Example:

```bash
curl -X GET "https://your-domain.com/admin/api/products?limit=50" \
  -H "X-API-Token: your_static_token_here"
```

Success response:

```json
{
  "success": true,
  "message": "Products fetched successfully.",
  "data": []
}
```

## Insert, Update, Delete Product

Endpoint:

```text
POST /admin/api/products/action
```

The request must include:

- `action`: one of `insert`, `update`, or `delete`.

### Insert Product

Required fields:

- `action`: `insert`
- `name`

Optional fields:

- `description`
- `category_id`
- `display_order`
- `product_image`
- `is_active`
- `ticket_id`
- `organizer_id`
- `event_id`
- `show_id`
- `price`
- `quantity`
- `sold`
- `min_purchase`
- `max_purchase`
- `currency`
- `is_gst`
- `convenience_fee`
- `valid_from`
- `valid_until`

Auto-handled fields:

- `app_id` is always set to `1011`.
- `created_at` and `updated_at` are set automatically.
- `is_active` defaults to `1` if not sent.

Example:

```bash
curl -X POST "https://your-domain.com/admin/api/products/action" \
  -H "X-API-Token: your_static_token_here" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "insert",
    "name": "VIP Ticket",
    "description": "VIP entry ticket",
    "category_id": 1,
    "price": 499.00,
    "quantity": 100,
    "currency": "USD"
  }'
```

### Update Product

Required fields:

- `action`: `update`
- `id`

Optional fields:

- Any insert product field except `app_id`, `created_at`, and `updated_at`.

Auto-handled fields:

- `app_id` is always forced to `1011`.
- `updated_at` is set automatically.

Example:

```bash
curl -X POST "https://your-domain.com/admin/api/products/action" \
  -H "X-API-Token: your_static_token_here" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "update",
    "id": 10,
    "name": "VIP Ticket Updated",
    "price": 599.00
  }'
```

### Delete Product

Required fields:

- `action`: `delete`
- `id`

Delete is a soft delete. It updates:

```text
is_active = 2
```

Example:

```bash
curl -X POST "https://your-domain.com/admin/api/products/action" \
  -H "X-API-Token: your_static_token_here" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "delete",
    "id": 10
  }'
```

## Error Responses

Invalid or missing token:

```json
{
  "success": false,
  "message": "Invalid or missing API token."
}
```

Validation error:

```json
{
  "success": false,
  "message": "Validation failed.",
  "errors": {}
}
```

Product not found:

```json
{
  "success": false,
  "message": "Product not found."
}
```