REST API · v1 · Laravel 13.31.0
WiseStore API
Backend service for the WiseStore multi-tenant retail platform. Bearer-authenticated JSON endpoints for point of sale, inventory, payments, reporting, and platform administration — powering wisestore.co.ke and every branch it serves.
Service
Base URL
https://api.wisestore.co.ke/api
Frontend
Auth
Bearer · Sanctum
Content-Type
application/json
Runtime
PHP 8.5.11
Environment
production
Required headers
| Header | Applies to | Description |
|---|---|---|
| Authorization | All authenticated routes | Bearer <sanctum-token> or Bearer <api-key> |
| X-Company-ID | Tenant-scoped routes | Tenant scope. Must match the authenticated user's company unless super admin. |
| X-Store-ID | Store-scoped routes | Branch context. Falls back to the user's primary store if omitted. |
| X-Company-Admin | Elevated routes | true grants tenant-admin operations for this request. |
| Idempotency-Key | POST /sales | Ensures queued offline sales are never double-posted. |
Quick start
bash — authenticate and call an endpoint
# 1. Obtain a bearer token curl -X POST "https://api.wisestore.co.ke/api/auth/login" \ -H "Content-Type: application/json" \ -d '{"email":"admin@demo.co.ke","password":"password"}' # Response → # { # "token": "1|abc123...", # "user": { "id": 1, "company_id": 1, "is_company_admin": true } # } # 2. Call a tenant-scoped endpoint curl "https://api.wisestore.co.ke/api/items" \ -H "Authorization: Bearer $TOKEN" \ -H "X-Company-ID: 1" \ -H "X-Store-ID: 1" # Response → # { # "data": [ { "id": 1, "name": "Item 1", "price": "100.00" }, ... ], # "meta": { "page": 1, "per_page": 25, "total": 20 } # }
Endpoint map
Authentication
PUBLIC
POST/api/auth/login
POST/api/auth/register
POST/api/auth/super-login
POST/api/auth/logout
GET/api/user
Sales & Till
TENANT
POST/api/sales · idempotent
GET/api/sales
GET/api/sales/{id}
POST/api/registers/open
POST/api/registers/close
GET/api/registers/current
GET/api/registers/{id}/report
GET/api/heldsales
POST/api/heldsales
Catalog & Inventory
TENANT
GET/api/items
POST/api/items
GET/api/inventory
POST/api/inventory/adjust
GET/api/stock-transfers
POST/api/stock-transfers/{id}/dispatch
POST/api/stock-transfers/{id}/receive
Money & Payments
TENANT
GET/api/payments-in
POST/api/payments-in
GET/api/payments-out
POST/api/payments-out
GET/api/receivables
GET/api/payables
POST/api/mpesa/stkpush
Reports
TENANT
GET/api/dashboard/summary
GET/api/reports/sales-by-day
GET/api/reports/sales-by-item
GET/api/reports/sales-by-cashier
GET/api/reports/stock-valuation
GET/api/reports/profit
GET/api/reports/vat
GET/api/reports/vat3 · Excel
Platform Admin
SUPER
GET/api/admin/plans
GET/api/admin/modules
GET/api/admin/tenants
POST/api/admin/companies/{id}/activate
POST/api/admin/companies/{id}/suspend
GET/api/admin/billing/invoices
GET/api/admin/revenue
Response shapes
json — standard responses
// List { "data": [ … ], "meta": { "page": 1, "per_page": 25, "total": 312 } } // Single { "data": { … } } // Validation error → HTTP 422 { "message": "The email field is required.", "errors": { "email": ["The email field is required."] } } // Unauthorized → HTTP 401 (always JSON, never 302) { "message": "Unauthenticated." }
Building an integration?
All endpoints respect the same headers and return the same envelope.
Start with
POST /api/auth/login,
then attach Authorization,
X-Company-ID, and
X-Store-ID on every subsequent call.
See the full reference for request bodies and validation rules.