# TibaLeta API

Base path: `/api/v1`

## Public endpoints

`GET /api/v1/services` — active services.

`GET /api/v1/practitioners/nearby?service={id}&lat={lat}&lng={lng}` — verified online practitioners. Public output deliberately excludes exact practitioner coordinates and direct email/user identifiers.

## Mobile authentication

`POST /api/v1/auth/login`

```json
{"email":"patient@tibaleta.test","password":"TibaLeta123!"}
```

Returns a bearer token. Store it in secure OS storage in a native client.

Authenticated mobile endpoints send:

```text
Authorization: Bearer <token>
```

Available mobile endpoints:

- `GET /api/v1/mobile/me`
- `POST /api/v1/mobile/logout`
- `POST /api/v1/mobile/patient/requests`
- `GET /api/v1/mobile/patient/requests/{id}`
- `GET /api/v1/mobile/practitioner/offers`
- `POST /api/v1/mobile/practitioner/offers/{assignmentId}/accept`
- `POST /api/v1/mobile/practitioner/offers/{assignmentId}/decline`

Browser-session request status also exists at `GET /api/v1/requests/{id}/status` and enforces ownership/assignment.

## Versioning

Keep breaking API changes under a new version prefix. Do not expose clinical narrative fields by default; add purpose-specific endpoints with role and relationship checks.
