API

Kumir developers

Native iOS/Android and partner integrations use versioned /api/v1. The machine-readable contract is OpenAPI 3.1 at GET /api/v1/openapi. Do not invent Stripe, APNs, FCM, or OAuth keys — missing providers return 501 or log-only, never a fake success.

Auth: POST /api/v1/auth/login returns an HS256 access token (1 hour) and a rotating refresh token (30 days). Send Authorization: Bearer … and X-Fameo-Channel: ios|android. Health probes /api/v1/health and /ready stay unauthenticated.

auth

POST /api/v1/auth/forgot
Request a password reset (same response if unknown email) · Public
POST /api/v1/auth/login
Email + password → HS256 access + refresh tokens · Public
POST /api/v1/auth/logout
Revoke refresh token; optional deviceToken drops push registration · Public
POST /api/v1/auth/oauth
Native Google/Apple id-token sign-in · Public
GET /api/v1/auth/oauth/callback
GET auth · oauth · callback · Public
POST /api/v1/auth/oauth/exchange
POST auth · oauth · exchange · Public
GET /api/v1/auth/oauth/start
GET auth · oauth · start · Public
POST /api/v1/auth/refresh
Rotate refresh token; 401 expires the family · Public
POST /api/v1/auth/register
Create a fan account (COPPA DOB check, verification email) · Public
POST /api/v1/auth/reset
Consume a hashed reset token and set a new password · Public
GET /api/v1/auth/sso
Which Google/Apple providers are configured (501 if none) · Public
POST /api/v1/auth/verify
Confirm email with a hashed token · Public
POST /api/v1/auth/verify/resend
Resend email verification · Public