Backend API endpoints

This inventory lists active server-side route declarations in routes/api.php, enabled module API route files, and the related web and tenant route files. Route paths below include the source prefix such as /api; the host and deployment base path are not established by this source review. These are backend declarations, not proof that a particular deployed client calls each route. The separate frontend interface map records client-to-endpoint references. See backend request flow for the authentication, tenant, and side-effect details.

Middleware groups

The application RouteServiceProvider adds the /api prefix and api middleware to every route in routes/api.php. That middleware group applies throttle:api and route-model binding. POST /api/login is in the API group only. Every other route from routes/api.php is inside the declared auth:sanctum then TenantMiddleware group.

Each enabled module route provider uses the /api prefix and api middleware. Its API route file adds auth:api. The checked module endpoints return the authenticated user; however, config/auth.php declares only a web guard. Runtime resolution of the module routes' api guard is unverified, so treat those entries as registered source paths whose callable behavior needs runtime confirmation.

Controllers also push jobs to named queues such as processing, export, and export-product-files. The default connection in config/queue.php is sync, but QUEUE_CONNECTION may override it; the effective runtime value was not inspected. A push may therefore run inline before the response or return after deferring work to a worker. A queue name or controller message alone does not prove asynchronous execution or completion.

Application API routes

The declarations in this section come from routes/api.php. All rows except login use the protected API group described above. Purposes summarize the mapped controller actions; comments and commented-out route examples are excluded.

Authentication and translation

Method	Effective path	Handler	Purpose
POST	/api/login	LoginController::login	Validate credentials and issue a Sanctum token.
POST	/api/translate	Route closure	Translate supplied text for requested stores; caught exceptions return a failure payload without an explicit error status.

Catalog attributes and families

Method	Effective path	Handler	Purpose
GET	/api/list-all-catalog-attributes	CatalogAttributeController::listAllCatalogAttributes	List product attributes with translation, filters, and optional pagination.
POST	/api/list-all-catalog-attributes	CatalogAttributeController::listAllCatalogAttributes	Same listing action using a POST request body.
GET	/api/get-attribute-options	CatalogAttributeController::getAttributeOptions	List an attribute's localized options.
POST	/api/getCodeAttr	CatalogAttributeController::getCodeAttr	Resolve attribute code data.
POST	/api/dataNameDescriptionProduct	CatalogProductController::dataNameDescriptionProduct	Read product name/description attribute data.
GET	/api/list-all-catalog-attribute-groups	CatalogAttributeGroupController::listAllCatalogAttributesGroup	List catalog attribute groups.
GET	/api/get-option-Translate/{id}	CatalogAttributeController::getOptionTranslateById	Read an option translation by ID.
POST	/api/edit-option-label	CatalogAttributeController::editOptionLabel	Change an option label.
GET	/api/all-type-attributes	CatalogAttributeController::getAllTypeAttr	List supported attribute types.
POST	/api/list-Attributes	CatalogAttributeController::listAttributes	Return the paginated/filterable attribute list used by the grid.
POST	/api/save-attribute	CatalogAttributeController::saveAttributes	Create/update an attribute and its translations, options, and family links; may push catalog sync work to the named export queue.
GET	/api/get-attributes/{id}	CatalogAttributeController::getAttributeById	Read one attribute by ID.
GET	/api/allAttributes	CatalogAttributeController::listsAllAttributes	List all attributes through the controller's all-attributes action.
POST	/api/to-remove-attribute	CatalogAttributeController::removeAttribute	Remove an attribute through the controller's remove action.
GET	/api/getAllFamilyForAttr	CatalogFamilyController::getAllFamily	List families for attribute selection.
POST	/api/families	CatalogFamilyController::index	Search/page through families and their grid-filter attributes.
GET	/api/family/{id}	CatalogFamilyController::show	Read a family and its attributes, translations, and variants.
POST	/api/family/{id}	CatalogFamilyController::show	Same family detail action using a POST request.
POST	/api/save-family	CatalogFamilyController::saveFamily	Create or update a family and related attribute/translation data.
POST	/api/save-product-families	CatalogFamilyController::saveProductFamilies	Update product-to-family associations.

Products, associations, and job status

Method	Effective path	Handler	Purpose
POST	/api/list-all-products	CatalogProductController::listAllProducts	Read the filtered product catalog through ProductQueryService.
GET	/api/products/{product}/images/download-zip	ProductImageDownloadController::downloadZip	Authorize, collect existing product images, and stream a ZIP archive.
GET	/api/products/{sku}/info	CatalogProductController::getProductInfoBySku	Return selected raw product fields; the handler has explicit 403 and 404 branches.
POST	/api/get-products-info-excel	CatalogProductController::getProductsInfoExcel	Build a product information export.
POST	/api/vimeo-stories/products	VimeoStoriesController::index	List product story records.
POST	/api/vimeo-stories/sync	VimeoStoriesController::sync	Run the story synchronization action.
GET	/api/vimeo-stories/products/{product}	VimeoStoriesController::show	Read story data for one product.
POST	/api/vimeo-stories/products/{product}/videos	VimeoStoriesController::saveVideo	Save a video entry for one product.
GET	/api/list-type-association	CatalogProductController::listTypeAssociationProduct	List active product-association types.
POST	/api/bulk-update-products	CatalogProductController::bulkUpdateProducts	Push a product attribute update to the named processing queue and notify the user; effective connection controls inline versus deferred execution.
POST	/api/bulk-update-products-excel	CatalogProductController::bulkUpdateProductsExcel	Push a spreadsheet product update to the named processing queue and notify the user; effective connection controls inline versus deferred execution.
POST	/api/bulk-update-products-names	CatalogProductController::bulkUpdateProductsNames	Push product name/description updates to the named processing queue and notify the user; effective connection controls inline versus deferred execution.
POST	/api/check-for-locked-products	CatalogProductController::checkForLockedProducts	Check product lock state.
POST	/api/lock-products	CatalogProductController::lockProducts	Apply product locks.
POST	/api/unlock-products	CatalogProductController::unLockProducts	Release product locks.
POST	/api/list-jobs-tracked	JobsTrackedController::listAllTrackedJobs	Search/page through tracked jobs.
GET	/api/job-tracked/{id}	JobsTrackedController::getTrackedJobById	Read a tracked job and its output.
GET	/api/has-job	JobsTrackedController::hasJob	Check whether a tracked Excel product update is active.
POST	/api/getListProductVersion	CatalogProductController::listVersionByProduct	Read product version history.
POST	/api/get-related-product	CatalogProductController::getRelatedProduct	Read related products by association type.
POST	/api/get-product-by-sku	CatalogProductController::getProductBySku	Read a product by SKU.
POST	/api/post-product-association	CatalogProductController::postProductAssociation	Create a product association.
POST	/api/remove-product-association	CatalogProductController::removeProductAssociationByType	Remove a product association by type.

Categories, locales, and channels

Method	Effective path	Handler	Purpose
GET	/api/get-categories	CatalogCategoryController::getCategories	List categories with localized labels.
GET	/api/get-categories-to-administrate	CatalogCategoryController::getCategoriesToAdministrate	Build the category administration tree.
POST	/api/update-categories-to-use-parent-category	CatalogCategoryController::updateCategoriesToUseParentCategory	Set the menu rows' parent-category flag.
POST	/api/update-categories-to-stop-using-parent-category	CatalogCategoryController::updateCategoriesToStopUsingParentCategory	Clear the menu rows' parent-category flag.
POST	/api/get-categories-menu	CatalogCategoryController::getCategoriesMenu	Read menu categories using the submitted level/store filters.
POST	/api/add-new-category	CatalogCategoryController::addNewCategory	Delegate category creation to the Shopify service under the mosaikasa tenant when present.
GET	/api/update-shopify-menu	CatalogCategoryController::updateShopifyMenu	Push UpdateShopifyMenu to the named export queue; effective connection determines inline versus deferred execution.
GET	/api/update-make-up-menu	MakeUpCatalogCategoryController::updateMakeUpMenu	Run makeup:update-menu inline with Artisan::call and return captured output without checking its exit code.
POST	/api/update-parent-category	CatalogCategoryController::updateParentCategory	Delegate parent-category changes to the Shopify service.
POST	/api/update-category-name	CatalogCategoryController::updateCategoryName	Delegate category-name changes to the Shopify service.
GET	/api/list-locales	CatalogLocaleController::listAllLocales	List catalog locales.
GET	/api/list-channels/{id}	CatalogChannelController::listAllCatalogChannels	List localized channels for an ID.
GET	/api/list-channels-static	CatalogChannelController::listAllCatalogChannelsStatic	List channels from the controller's static listing action.

Users, notifications, and currencies

Method	Effective path	Handler	Purpose
GET	/api/me	UserController::me	Return the authenticated user.
POST	/api/notifications	NotificationController::listNotifications	List notifications for the authenticated user and return an unread count.
POST	/api/read-notification	NotificationController::readNotification	Mark one of the authenticated user's notifications as read.
POST	/api/list-all-users	UserController::listUsers	Search/page through users.
PUT	/api/update-user	UserController::updateUser	Update a user.
POST	/api/create-user	UserController::creatNewUser	Create a user.
GET	/api/get-user/{id}	UserController::getUserBuyId	Read a user by ID.
PUT	/api/change-password	UserController::changePasswordUser	Change a user's password.
POST	/api/users/assign-attributes	UserController::assignDefaultAttributesToUser	Assign default attributes and positions to a user.
GET	/api/users/assigned-attributes	UserController::getDefaultAttributesAssignedToUser	Read the current user's assigned default attributes.
POST	/api/users/assign-attributes-without-position	UserController::assignDefaultAttributesToUserWithoutPosition	Assign default attributes without positions.
GET	/api/currencies	CatalogCurrencyController::index	List activated currencies.
POST	/api/currencies	CatalogCurrencyController::store	Registered by apiResource; no store method is present in this controller.
GET	/api/currencies/{currency}	CatalogCurrencyController::show	Registered by apiResource; no show method is present in this controller.
PUT, PATCH	/api/currencies/{currency}	CatalogCurrencyController::update	Registered by apiResource; no update method is present in this controller.
DELETE	/api/currencies/{currency}	CatalogCurrencyController::destroy	Registered by apiResource; no destroy method is present in this controller.

The currency paths are generated by the active Route::apiResource declaration. The controller implements index() only; the other registered paths are not supported contracts in this source snapshot.

Menu and media

Method	Effective path	Handler	Purpose
GET	/api/categories/{categoryId}/{storeId}/hierarchy	MenuController::getCategoryHierarchyStore	Read a category hierarchy for a store.
GET	/api/menu-tree	MenuController::getFormattedMenuForTreeSelect	Return the formatted menu tree.
POST	/api/menu/save-menu-item	MenuController::saveMenuItem	Save menu-item details and optional image data.
GET	/api/menu/get-attributes	MenuController::getAttributeIds	Read attribute IDs used by menu configuration.
GET	/api/menu/get-default-attribute-ids-to-show	MenuController::getDefaultAttributeIdsToShow	Read default category attributes.
GET	/api/menu/export-menu-csv	MenuController::exportMenuToCSV	Export menu configuration as CSV.
POST	/api/menu/save-menu	MenuController::saveMenu	Persist menu hierarchy/order, category attributes, metadata, and staged images.
POST	/api/menu/upload-category-image	MenuController::uploadCategoryImage	Stage category images and return temporary paths.
POST	/api/upload-images	UploadProductImagesController::saveTmpImages	Stage product images and return temporary paths.
POST	/api/save-images	UploadProductImagesController::saveImages	Move new staged images and update raw_values; removals clear references without deleting stored files. Caught failures return HTTP 200 JSON with success: false.
GET	/api/menu/export-menu-json	MenuController::exportMenuToJson	Export menu configuration as JSON.
POST	/api/upload-file	UploadProductFileController::saveTmpFile	Stage product files and return temporary paths.
POST	/api/save-files	UploadProductFileController::saveFiles	Move new staged GIF/PDF files and update raw_values; removals clear references without deleting stored files, then push a CSV/FTP export job to the named queue.

Asir product-attribute mapping

These routes use AsirGroupProductAttributeController and share the protected API middleware group.

Method	Effective path	Handler	Purpose
GET	/api/asir-product-attributes	AsirGroupProductAttributeController::getAllAttributes	List mapped attributes.
GET	/api/asir-product-attributes/sync-progress	AsirGroupProductAttributeController::getSyncProgress	Read synchronization progress.
GET	/api/asir-product-attributes/{attributeId}/attribute-families	AsirGroupProductAttributeController::getAttributeFamilies	Read families linked to an attribute.
GET	/api/asir-product-attributes/custom-asir-category	AsirGroupProductAttributeController::getCustomAsirCategory	Read the custom Asir category.
GET	/api/asir-product-attributes/{status}	AsirGroupProductAttributeController::getAttributesByStatus	Filter mapped attributes by status.
GET	/api/asir-product-attributes/{attributeId}/sample-product	AsirGroupProductAttributeController::getSampleProductDataByAttributeId	Read sample product data for an attribute.
GET	/api/asir-product-attributes/{attributeId}/options	AsirGroupProductAttributeController::getOptionsByAttribute	Read options for an attribute.
POST	/api/asir-product-attributes	AsirGroupProductAttributeController::saveAttribute	Create a mapped attribute.
POST	/api/asir-product-attribute-options	AsirGroupProductAttributeController::saveAttributeOption	Create an attribute option.
PUT	/api/asir-product-attributes	AsirGroupProductAttributeController::updateAttributes	Update mapped attributes.
PUT	/api/asir-product-attribute-options	AsirGroupProductAttributeController::updateAttributeOptions	Update mapped attribute options.
PUT	/api/asir-product-attribute-families	AsirGroupProductAttributeController::updateAttributeFamilies	Update attribute-family links.
POST	/api/asir-product-attributes/synchronize	AsirGroupProductAttributeController::synchronizeAsirAttributes	Start the synchronization action.

Module API identity routes

The enabled module route providers prefix these routes with /api. Each source handler returns $request->user() and declares auth:api; the missing api guard configuration described above remains an unresolved runtime dependency.

Method	Effective path	Module source	Purpose
GET	/api/menzzo	Menzzo route	Return authenticated user.
GET	/api/logidav	Logidav route	Return authenticated user.
GET	/api/bigbuy	Bigbuy route	Return authenticated user.
GET	/api/vidaxl	Vidaxl route	Return authenticated user.
GET	/api/meublepromo	MeublePromo route	Return authenticated user.
GET	/api/newshopifywebsite	Mosaikasa route	Return authenticated user.
GET	/api/makeup	MakeUp route	Return authenticated user.
GET	/api/merchantcenter	MerchantCenter route	Return authenticated user.

The two additional Vidaxl product/category route lines in that route file are comments and are excluded from this inventory. No active API routes were found in the enabled Ameubleo module because it has no module HTTP route provider.

Web and tenant routes

These declarations are outside the JSON API group. The application and module pages use the web middleware group; tenant / adds the domain-initialization and central-domain middleware. Source paths and handler scope are provided so callers do not mistake these pages for /api routes.

Method	Effective path	Handler	Middleware and purpose
GET	/	routes/web.php closure	web; return the welcome view.
GET	/img/{path}	ImageController::show	web; serve or transform a stored image, falling back to the default image.
GET	/google-oauth/get-response	GoogleAccessController::handleGoogleResponse	web; handle the Merchant Center OAuth response.
GET	/menzzo	MenzzoController::index	web; Menzzo module landing page.
GET	/logidav	LogidavController::index	web; Logidav module landing page.
GET	/bigbuy	BigbuyController::index	web; Bigbuy module landing page.
GET	/meublepromo	MeublePromoController::index	web; MeublePromo module landing page.
GET	/makeup	MakeUpController::index	web; MakeUp module landing page.
GET	/Mosaikasa	NewShopifyWebsiteController::index	web; Mosaikasa module landing page.
GET	/merchantcenter	MerchantCenterController::index	web; Merchant Center module landing page.
GET	/	routes/tenant.php closure	web, InitializeTenancyByDomain, PreventAccessFromCentralDomains; return a placeholder string containing the current tenant ID.

Both the app web file and tenant route file declare GET /. The source review does not resolve which registration wins in the running route collection. Module prefixes and their web middleware are declared in the respective module route providers.

Evidence limits

This inventory was checked against axelites/menzzo-meduse commit 5d3de6cb63b976aaeef739a8a7f288c4b46509ad. It is a static source inventory: no application boot, Artisan route listing, HTTP call, database, host, credential, or production access was performed. Middleware resolution, route ordering, deployed prefixes, client use, and endpoint responses remain unverified at runtime.