Surfaces, roles and current terminology

Permissions, settings and activation

• Public means no api.auth middleware is declared at the route level; controller checks, request-type middleware, entitlement, and data visibility can still restrict a response.
• api.auth protects the main /panel group. A subset also uses api.level-access:teacher for teacher-level operations.
• All /instructor routes inherit both api.auth and api.level-access:teacher from the parent group.
• Document each concrete endpoint with method, full path, access/middleware, purpose, path/query/body fields, response fields, state/error semantics, side effects, idempotency expectations, and review/support status.
• Use the exact controller response as the authority for payload shape. The route declarations do not define a universal JSON schema.

Core workflows

Build an endpoint reference entry

1. Start with the base prefix /api/development and append the exact declared route, including /panel or /instructor where applicable.
2. Record the HTTP method and every path parameter; inspect the controller/request validator for query and body fields.
3. Record route middleware as Public, api.auth, or api.auth + teacher, plus request-type/format middleware where declared.
4. Capture representative success and error response fields from the controller and tests rather than assuming a common envelope.
5. Mark side effects and whether retrying can create duplicate carts, payments, messages, notifications, reservations, or submissions.

Authenticate and call protected families

1. Use the declared login or registration flow and retain the credential/token format returned by the active controller.
2. Send the authentication data expected by api.auth and the request type expected by api.request.type where required.
3. Call Panel routes only for the authenticated account and Instructor routes only for teacher-level accounts.
4. Treat 401/403-style outcomes and controller-specific denied responses as access failures, not empty data.

Review routes before claiming support

1. Review POST /notification/new: it is declared in the public guest group and directly targets a supplied device token; do not publish it as a supported client feature without an explicit security/support decision.
2. Review GET /instructor/meetings: its current closure contains a debug dump, so the route declaration is not evidence of a functioning endpoint.
3. Review public content-item reads declared after the authenticated Panel group, especially files, sessions, lessons, assignments, and quizzes, for controller-level entitlement checks.
4. Review duplicate/legacy-looking families such as Panel reviews and account/content deletion routes before choosing the canonical mobile call.
5. Verify social callbacks, payment verification, downloads, and live-session launch behavior on the target deployment because redirects and provider setup affect API suitability.

Result states

• Success: The endpoint matches its documented method/path, access boundary, validated fields, and observed controller response; side effects occur once.
• Pending: A payment, offline approval, support reply, assignment grade, reservation, notification, or deletion request is accepted but not complete.
• Denied: Authentication is missing/invalid, teacher access is absent, entitlement or ownership fails, or controller policy rejects the request.
• Error: Validation, unavailable provider/configuration, debug handler, controller exception, or unsupported legacy route prevents a reliable response; mark the endpoint for review rather than promising support.

Operational notes

• Source catalogue reviewed: routes/api.php, routes/api/auth.php, routes/api/guest.php, routes/api/user.php, and routes/api/instructor.php.
• Route presence proves registration only. Production support also requires a working controller, validation, authorization, dependencies, stable response contract, and deployment configuration.
• The literal development segment is part of the current source prefix despite the API serving application features.

Related guides

• Login and Register
• Panel Overview
• Cart, Checkout and Payments
• Learning Page
• Panel Education and Evaluation
• Security Settings