# API Documentation

Base URL: `https://jobs.mytoolshub.co.in/api/`

All responses follow this shape:
```json
{ "success": true|false, "message": "...", "data": {...} }
```
Errors additionally may include an `errors` object with details.

Protected endpoints need this header:
```
Authorization: Bearer <jwt_token>
```
Token milta hai `verify-otp` ya `login` se, aur 30 din tak valid rehta hai.

---

## Auth APIs

### POST `/api/auth/register.php`
Body: `{ "full_name", "mobile_number", "email"(optional), "password", "confirm_password" }`
→ OTP generate hota hai, mobile par jaata hai (jab tak SMS gateway wire nahi, `DEV_MODE=true` hone par response me `otp_dev_only` field aata hai).

### POST `/api/auth/verify-otp.php`
Body: `{ "mobile_number", "otp" }`
→ Success par `token` + `user` object milta hai. Isi token se aage saari protected calls hongi.

### POST `/api/auth/login.php`
Body: `{ "mobile_number", "password" }` → `token` + `user`

### POST `/api/auth/forgot-password.php`
Body: `{ "mobile_number" }` → naya OTP bhejta hai

### POST `/api/auth/reset-password.php`
Body: `{ "mobile_number", "otp", "new_password", "confirm_password" }`

---

## User APIs (🔒 protected)

### GET `/api/user/get-profile.php`
→ Full profile (users + user_profiles joined) + latest resume path

### POST `/api/user/update-profile.php`
Body: koi bhi subset — `full_name, email, dob, gender, address, city_id, state_id, pincode, education, experience, current_company, skills, languages, about`

### POST `/api/user/upload-resume.php`
`multipart/form-data`, field name `resume` (PDF/DOC/DOCX, max 5MB)

### POST `/api/user/change-password.php`
Body: `{ "current_password", "new_password", "confirm_password" }`

### POST `/api/user/toggle-save-job.php`
Body: `{ "job_id" }` → save/unsave toggle

### GET `/api/user/saved-jobs.php`
→ List of saved jobs

---

## Job APIs

### POST `/api/job/create-vacancy.php` 🔒
Body: `{ "action": "draft"|"publish", ...vacancy fields }`
- `draft` → koi bhi field optional, jitna bhara ho save ho jaata hai
- `publish` → in fields ke bina reject hoga: `company_name, recruiter_name, mobile_number, job_title, category_id, job_location, experience_required, education_required, job_type, description`
- Publish hote hi status `pending` (admin approval ka wait) — direct live nahi hoti

### POST `/api/job/update-vacancy.php` 🔒
Body: `{ "job_id", ...fields to change, "action":"publish" (optional) }` — sirf apni khud ki job edit kar sakte ho. Approved job dobara edit karne par status wapas `pending` ho jaata hai (re-review).

### POST `/api/job/delete-vacancy.php` 🔒
Body: `{ "job_id" }`

### GET `/api/job/job-list.php`
Query params (sab optional):
- `section` = `latest` | `featured` | `urgent` | `nearby` | `recommended`
- `q` (search), `category_id`, `city_id`, `state_id`, `salary_min`, `experience`, `education`, `company`, `job_type`
- `page`, `per_page` (max 50)
- Token optional — logged in ho to `is_saved` flag milta hai; `nearby`/`recommended` ke liye token zaroori hai

### GET `/api/job/job-details.php?id=123`
→ Full job detail. Token optional — diya ho to `is_saved`/`is_applied` flags milte hain. View count auto-increment hota hai (owner ke liye nahi).

---

## Application APIs (🔒 sab protected)

### POST `/api/application/apply-job.php`
Body: `{ "job_id" }` — resume automatically latest uploaded wali attach ho jaati hai. Resume upload na ho to error milega.

### GET `/api/application/my-applications.php?status=` (status optional filter)
→ Apni saari applications

### GET `/api/application/received-applications.php?job_id=&status=`
→ Apni jobs par aayi applications (applicant details + resume path ke saath)

### POST `/api/application/update-status.php`
Body: `{ "application_id", "status", "remarks"(optional) }`
Status values: `under_review, shortlisted, interview_scheduled, selected, rejected`
→ Sirf job ka owner update kar sakta hai, applicant ko notification chala jaata hai

### POST `/api/application/mark-resume-viewed.php`
Body: `{ "application_id" }` → applicant ko "Resume Viewed" notification

### POST `/api/application/withdraw-application.php`
Body: `{ "application_id" }` → sirf tab tak allowed jab tak status `applied` hai (review shuru hone se pehle)

---

## Notification APIs 🔒

### GET `/api/notification/notification-list.php`
→ Apni personal + saare broadcast notifications, `is_read` per-user sahi calculate hoke aata hai

### POST `/api/notification/mark-read.php`
Body: `{ "notification_id" }`

---

## Content API (public)

### GET `/api/content/get-page.php` → sab CMS pages ki list (slug+title)
### GET `/api/content/get-page.php?slug=about-us` → ek page ka full content

Available slugs: `about-us`, `privacy-policy`, `terms`, `contact-us`, `help-center`

---

## Common Error Codes

| Code | Meaning |
|------|---------|
| 401 | Token missing/invalid/expired, ya wrong login credentials |
| 403 | Login to sahi hai par is action ka permission nahi (e.g. doosre ki job edit karna) |
| 404 | Record nahi mila |
| 405 | Galat HTTP method (GET endpoint ko POST se hit kiya, ya ulta) |
| 409 | Duplicate (already applied / mobile already registered) |
| 422 | Validation fail (required field missing, galat format) |
| 500 | Server error |

## Example: Full flow (register → apply to a job)

```
1. POST /api/auth/register.php          → OTP milega
2. POST /api/auth/verify-otp.php        → token milega
3. POST /api/user/upload-resume.php     → resume chahiye apply se pehle
4. GET  /api/job/job-list.php?section=latest
5. POST /api/application/apply-job.php  → { "job_id": <id from step 4> }
6. GET  /api/application/my-applications.php
```