REST API
The API is served under /api/. Authenticate with the login route, send the access token as a bearer token, and use the role required by each route.
Example request
curl -X POST -H 'Content-Type: application/json' \
-d '{"username":"admin@example.com","password":"changeme"}' \
http://localhost:8080/api/auth/login
curl -H 'Authorization: Bearer <token>' \
http://localhost:8080/api/sections
The demo credentials are for local use only. Replace them before exposing the app.
Routes and roles
Login is public. User and section administration and cache flushing require an administrator. Translation reads and writes require the editor role or higher. A missing or invalid token returns 401; an authenticated user without the required role receives 403. Write routes validate allowed fields.
For deployment diagnostics use vendor/bin/wbengine.php doctor; it does not change the schema. The endpoint list and request console below this article show the routes enabled by this skeleton. Check the current route classes before relying on an example in another application.