LOOP Developer Portal

Base URL

https://loopbackend.duckdns.org/api/v1/

Use ?format=json on this page for metadata JSON.

Documentation

Swagger / OpenAPI ReDoc Internal Guide JSON Reference

Status

https://loopbackend.duckdns.org/health/

Returns app, database, environment, version, and timestamp.

Authentication

JWT: Authorization: Bearer <access_token>
Internal server key: X-LOOP-API-KEY: <internal_key>
Never expose internal keys in browser JavaScript.

Tenant Header

Send X-Company-ID: 001, 002, or another company code for tenant-scoped requests.
The API checks active membership or internal key company access.
Workspaces can use X-Workspace-ID.

Core APIs

/companies/
/workspaces/
/developer-profiles/
/api-client-apps/
/internal-api-keys/
/memberships/

Product APIs

Booking, Payments, CRM, Desk, Tasks, Commerce, Inventory, POS, NGO, School, Church, Care, Attendance, Events, Logistics, Fleet, Media, Forms, Docs, Security, CyberTrust, AI, Chat, Protector, CMS, and all remaining sector modules share the same tenant and authentication model.

Example Requests

RegisterPOST

/api/v1/auth/register/

curl -X POST https://loopbackend.duckdns.org/api/v1/auth/register/ \
  -H "Authorization: Bearer " \
  -H "X-Company-ID: 001" \
  -H "X-LOOP-APP-ID: loop-booking-web" \
  -H "Content-Type: application/json" \
  -d '{"email":"dev@example.com","username":"dev","password":"strongpass123","company_name":"Demo Company"}'

LoginPOST

/api/v1/auth/login/

curl -X POST https://loopbackend.duckdns.org/api/v1/auth/login/ \
  -H "Authorization: Bearer " \
  -H "X-Company-ID: 001" \
  -H "X-LOOP-APP-ID: loop-booking-web" \
  -H "Content-Type: application/json" \
  -d '{"email":"dev@example.com","password":"strongpass123"}'

Current userGET

/api/v1/auth/me/

curl -X GET https://loopbackend.duckdns.org/api/v1/auth/me/ \
  -H "Authorization: Bearer " \
  -H "X-Company-ID: 001" \
  -H "X-LOOP-APP-ID: loop-booking-web"

CompaniesGET

/api/v1/companies/

curl -X GET https://loopbackend.duckdns.org/api/v1/companies/ \
  -H "Authorization: Bearer " \
  -H "X-Company-ID: 001" \
  -H "X-LOOP-APP-ID: loop-booking-web"

Booking appointmentPOST

/api/v1/booking/appointments/

curl -X POST https://loopbackend.duckdns.org/api/v1/booking/appointments/ \
  -H "Authorization: Bearer " \
  -H "X-Company-ID: 001" \
  -H "X-LOOP-APP-ID: loop-booking-web" \
  -H "Content-Type: application/json" \
  -d '{"title":"Consultation","description":"First visit"}'

Payments invoicePOST

/api/v1/payments/invoices/

curl -X POST https://loopbackend.duckdns.org/api/v1/payments/invoices/ \
  -H "Authorization: Bearer " \
  -H "X-Company-ID: 001" \
  -H "X-LOOP-APP-ID: loop-booking-web" \
  -H "Content-Type: application/json" \
  -d '{"title":"Invoice 001","data":{"amount":25000,"currency":"RWF"}}'

CMS pagePOST

/api/v1/cms/pages/

curl -X POST https://loopbackend.duckdns.org/api/v1/cms/pages/ \
  -H "Authorization: Bearer " \
  -H "X-Company-ID: 001" \
  -H "X-LOOP-APP-ID: loop-booking-web" \
  -H "Content-Type: application/json" \
  -d '{"title":"Home","slug":"home","language":"en","body":"Welcome to LOOP"}'

Chat messagePOST

/api/v1/chat/messages/

curl -X POST https://loopbackend.duckdns.org/api/v1/chat/messages/ \
  -H "Authorization: Bearer " \
  -H "X-Company-ID: 001" \
  -H "X-LOOP-APP-ID: loop-booking-web" \
  -H "Content-Type: application/json" \
  -d '{"title":"Customer question","description":"Hello LOOP"}'

AI business advicePOST

/api/v1/ai/business-advice/

curl -X POST https://loopbackend.duckdns.org/api/v1/ai/business-advice/ \
  -H "Authorization: Bearer " \
  -H "X-Company-ID: 001" \
  -H "X-LOOP-APP-ID: loop-booking-web" \
  -H "Content-Type: application/json" \
  -d '{"prompt":"Summarize this week sales"}'

Protector public verifyGET

/api/v1/protector/public-verify/IHEMATST1/

curl -X GET https://loopbackend.duckdns.org/api/v1/protector/public-verify/IHEMATST1/ \
  -H "Authorization: Bearer " \
  -H "X-Company-ID: 001" \
  -H "X-LOOP-APP-ID: loop-booking-web"

Assets

/api/assets/

Logo, transparent wordmark, favicon, and app icons for LOOP clients.

Security Notes

Rate limiting and pagination are enabled.
Secure headers and HTTPS proxy detection are configured.
Admin access should stay staff-only and protected by strong credentials.
Errors use a standard JSON envelope.