{
  "info": {
    "name": "Hexa Fitness - Client & Admin API",
    "description": "Client onboarding funnel (Request Access -> Sandbox -> Activation -> Payments Enablement), the Client's own dashboard, and the Admin console. See CLIENT_ADMIN_API_GUIDE.md in the repo root for auth details.",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
  },
  "variable": [
    { "key": "baseUrl", "value": "http://localhost:5601" },
    { "key": "mobileNumber", "value": "+94770000000" },
    { "key": "otpReferenceNumber", "value": "" },
    { "key": "otpCode", "value": "123456" },
    { "key": "requestAccessToken", "value": "" },
    { "key": "onboardingRequestId", "value": "" },
    { "key": "sandboxToken", "value": "" },
    { "key": "activationToken", "value": "" },
    { "key": "mobileAuthToken", "value": "", "description": "AuthHex-issued JWT for a logged-in Client/Admin; sent as the MobileAuthToken header consumed by [CustomMiddleware]" },
    { "key": "clientId", "value": "" },
    { "key": "customerId", "value": "" },
    { "key": "staffId", "value": "" },
    { "key": "customerInvoiceId", "value": "" }
  ],
  "auth": {
    "type": "apikey",
    "apikey": [
      { "key": "key", "value": "MobileAuthToken", "type": "string" },
      { "key": "value", "value": "{{mobileAuthToken}}", "type": "string" },
      { "key": "in", "value": "header", "type": "string" }
    ]
  },
  "item": [
    {
      "name": "Client - Onboarding (Request Access)",
      "item": [
        {
          "name": "Send Mobile OTP",
          "request": {
            "method": "POST",
            "header": [{ "key": "Content-Type", "value": "application/json" }],
            "url": "{{baseUrl}}/api/client/onboarding/requests/otp",
            "body": {
              "mode": "raw",
              "raw": "{\n  \"mobileNumber\": \"{{mobileNumber}}\"\n}"
            },
            "auth": { "type": "noauth" }
          }
        },
        {
          "name": "Verify Mobile OTP",
          "request": {
            "method": "POST",
            "header": [{ "key": "Content-Type", "value": "application/json" }],
            "url": "{{baseUrl}}/api/client/onboarding/requests/otp/verify",
            "body": {
              "mode": "raw",
              "raw": "{\n  \"mobileNumber\": \"{{mobileNumber}}\",\n  \"referenceNumber\": \"{{otpReferenceNumber}}\",\n  \"otpCode\": \"{{otpCode}}\"\n}"
            },
            "auth": { "type": "noauth" },
            "description": "mobileNumber must match the number OTP was sent to in the previous step. Response.data.requestAccessToken -> save into the {{requestAccessToken}} collection variable."
          }
        },
        {
          "name": "Create Onboarding Request",
          "request": {
            "method": "POST",
            "header": [
              { "key": "Content-Type", "value": "application/json" },
              { "key": "Authorization", "value": "Bearer {{requestAccessToken}}" }
            ],
            "url": "{{baseUrl}}/api/client/onboarding/requests",
            "body": {
              "mode": "raw",
              "raw": "{\n  \"ownerName\": \"Ashan Perera\",\n  \"gymName\": \"IronCore Fitness\",\n  \"city\": \"Colombo\"\n}"
            },
            "auth": { "type": "noauth" },
            "description": "Response.data.onboardingRequestId -> {{onboardingRequestId}} (also doubles as {{activationToken}} once approved). Response.data.sandboxToken -> {{sandboxToken}}."
          }
        },
        {
          "name": "Get Sandbox Status",
          "request": {
            "method": "GET",
            "url": "{{baseUrl}}/api/client/onboarding/sandbox/{{sandboxToken}}/status",
            "auth": { "type": "noauth" }
          }
        },
        {
          "name": "Update Sandbox Progress",
          "request": {
            "method": "PATCH",
            "header": [{ "key": "Content-Type", "value": "application/json" }],
            "url": "{{baseUrl}}/api/client/onboarding/sandbox/{{sandboxToken}}/progress",
            "body": {
              "mode": "raw",
              "raw": "{\n  \"tourStepCompleted\": \"added_first_customer\",\n  \"minutesElapsedDelta\": 2\n}"
            },
            "auth": { "type": "noauth" }
          }
        }
      ]
    },
    {
      "name": "Client - Activation",
      "item": [
        {
          "name": "Send Activation Email OTP",
          "request": {
            "method": "POST",
            "header": [{ "key": "Content-Type", "value": "application/json" }],
            "url": "{{baseUrl}}/api/client/activation/{{activationToken}}/email/otp",
            "body": {
              "mode": "raw",
              "raw": "{\n  \"email\": \"owner@ironcore.gym\"\n}"
            },
            "auth": { "type": "noauth" },
            "description": "activationToken = OnboardingRequest.Id, only valid once Admin has set status to Approved."
          }
        },
        {
          "name": "Verify Activation Email OTP",
          "request": {
            "method": "POST",
            "header": [{ "key": "Content-Type", "value": "application/json" }],
            "url": "{{baseUrl}}/api/client/activation/{{activationToken}}/email/otp/verify",
            "body": {
              "mode": "raw",
              "raw": "{\n  \"referenceNumber\": \"{{otpReferenceNumber}}\",\n  \"otpCode\": \"{{otpCode}}\"\n}"
            },
            "auth": { "type": "noauth" }
          }
        },
        {
          "name": "Upload NIC",
          "request": {
            "method": "POST",
            "url": "{{baseUrl}}/api/client/activation/{{activationToken}}/nic",
            "body": {
              "mode": "formdata",
              "formdata": [
                { "key": "nicNumber", "value": "902345678V", "type": "text" },
                { "key": "frontImage", "type": "file", "src": [] },
                { "key": "backImage", "type": "file", "src": [] }
              ]
            },
            "auth": { "type": "noauth" }
          }
        },
        {
          "name": "Update Gym Profile",
          "request": {
            "method": "PUT",
            "header": [{ "key": "Content-Type", "value": "application/json" }],
            "url": "{{baseUrl}}/api/client/activation/{{activationToken}}/gym-profile",
            "body": {
              "mode": "raw",
              "raw": "{\n  \"gymName\": \"IronCore Fitness\",\n  \"address\": \"123 Galle Road\",\n  \"city\": \"Colombo\"\n}"
            },
            "auth": { "type": "noauth" }
          }
        },
        {
          "name": "Set Payment Method",
          "request": {
            "method": "POST",
            "header": [{ "key": "Content-Type", "value": "application/json" }],
            "url": "{{baseUrl}}/api/client/activation/{{activationToken}}/payment-method",
            "body": {
              "mode": "raw",
              "raw": "{\n  \"payHereToken\": \"tok_test_4242424242424242\"\n}"
            },
            "auth": { "type": "noauth" },
            "description": "payHereToken comes from PayHere.js tokenizing the card client-side; this is opaque staging data server-side."
          }
        },
        {
          "name": "Charge & Activate",
          "request": {
            "method": "POST",
            "url": "{{baseUrl}}/api/client/activation/{{activationToken}}/charge",
            "auth": { "type": "noauth" },
            "description": "Creates real User/Client/ClientBusiness/ClientCard/ClientWallet rows and registers the Client with AuthHex. Response.data.accessToken/refreshToken are the caller's new session tokens; save accessToken into {{mobileAuthToken}} for the authenticated requests below."
          }
        },
        {
          "name": "Get Activation Checklist",
          "request": {
            "method": "GET",
            "url": "{{baseUrl}}/api/client/activation/{{activationToken}}/checklist",
            "auth": { "type": "noauth" }
          }
        }
      ]
    },
    {
      "name": "Client - Own Profile & Business",
      "item": [
        { "name": "Get My Profile", "request": { "method": "GET", "url": "{{baseUrl}}/api/client/me" } },
        { "name": "Get Packages", "request": { "method": "GET", "url": "{{baseUrl}}/api/client/packages" } }
      ]
    },
    {
      "name": "Client - Customers",
      "item": [
        { "name": "Get Customers", "request": { "method": "GET", "url": "{{baseUrl}}/api/client/customers" } },
        { "name": "Get Customer By Id", "request": { "method": "GET", "url": "{{baseUrl}}/api/client/customers/{{customerId}}" } },
        {
          "name": "Create Customer",
          "request": {
            "method": "POST",
            "header": [{ "key": "Content-Type", "value": "application/json" }],
            "url": "{{baseUrl}}/api/client/customers",
            "body": {
              "mode": "raw",
              "raw": "{\n  \"fullname\": \"Nimal Silva\",\n  \"userName\": \"nimal.silva\",\n  \"email\": \"nimal@example.com\",\n  \"phoneNumber\": \"+94771234567\",\n  \"nic\": \"985432109V\",\n  \"gender\": \"Male\",\n  \"birthday\": \"1998-05-12\",\n  \"workoutPlanIds\": [],\n  \"mealPlanIds\": [],\n  \"customerPlanId\": null\n}"
            }
          }
        },
        {
          "name": "Update Customer",
          "request": {
            "method": "PUT",
            "header": [{ "key": "Content-Type", "value": "application/json" }],
            "url": "{{baseUrl}}/api/client/customers/{{customerId}}",
            "body": {
              "mode": "raw",
              "raw": "{\n  \"fullname\": \"Nimal Silva\",\n  \"userName\": \"nimal.silva\",\n  \"email\": \"nimal@example.com\",\n  \"phoneNumber\": \"+94771234567\",\n  \"nic\": \"985432109V\",\n  \"gender\": \"Male\",\n  \"birthday\": \"1998-05-12\"\n}"
            }
          }
        },
        { "name": "Delete Customer", "request": { "method": "DELETE", "url": "{{baseUrl}}/api/client/customers/{{customerId}}" } }
      ]
    },
    {
      "name": "Client - Staff",
      "item": [
        { "name": "Get Staff (own client)", "request": { "method": "GET", "url": "{{baseUrl}}/api/client/staff" } },
        { "name": "Get Staff By Id", "request": { "method": "GET", "url": "{{baseUrl}}/api/client/staff/{{staffId}}" } },
        {
          "name": "Create Staff",
          "request": {
            "method": "POST",
            "header": [{ "key": "Content-Type", "value": "application/json" }],
            "url": "{{baseUrl}}/api/client/staff",
            "body": {
              "mode": "raw",
              "raw": "{\n  \"userName\": \"kasun.trainer\",\n  \"email\": \"kasun@ironcore.gym\",\n  \"phoneNumber\": \"+94779876543\",\n  \"staffPosition\": \"Trainer\",\n  \"department\": \"Fitness Floor\",\n  \"hireDate\": \"2026-07-01T00:00:00Z\"\n}"
            }
          }
        },
        {
          "name": "Update Staff",
          "request": {
            "method": "PUT",
            "header": [{ "key": "Content-Type", "value": "application/json" }],
            "url": "{{baseUrl}}/api/client/staff/{{staffId}}",
            "body": {
              "mode": "raw",
              "raw": "{\n  \"userName\": \"kasun.trainer\",\n  \"email\": \"kasun@ironcore.gym\",\n  \"phoneNumber\": \"+94779876543\",\n  \"staffPosition\": \"Senior Trainer\",\n  \"department\": \"Fitness Floor\"\n}"
            }
          }
        },
        { "name": "Delete Staff (soft)", "request": { "method": "DELETE", "url": "{{baseUrl}}/api/client/staff/{{staffId}}?softDelete=true" } }
      ]
    },
    {
      "name": "Client - Customer Invoices",
      "item": [
        { "name": "Get Customer Invoices", "request": { "method": "GET", "url": "{{baseUrl}}/api/client/customer-invoices" } },
        { "name": "Get Customer Invoice By Id", "request": { "method": "GET", "url": "{{baseUrl}}/api/client/customer-invoices/{{customerInvoiceId}}" } }
      ]
    },
    {
      "name": "Client - Dashboard Stats",
      "item": [
        { "name": "Get Stat Summary", "request": { "method": "GET", "url": "{{baseUrl}}/api/client/stats/summary" } },
        { "name": "Get Monthly Revenue", "request": { "method": "GET", "url": "{{baseUrl}}/api/client/stats/monthly-revenue" } },
        { "name": "Get Recent Payments", "request": { "method": "GET", "url": "{{baseUrl}}/api/client/stats/recent-payments" } }
      ]
    },
    {
      "name": "Client - Payments Enablement",
      "item": [
        { "name": "Get Payment Tracks", "request": { "method": "GET", "url": "{{baseUrl}}/api/client/payments/tracks" } },
        {
          "name": "Select Payment Track",
          "request": {
            "method": "POST",
            "header": [{ "key": "Content-Type", "value": "application/json" }],
            "url": "{{baseUrl}}/api/client/payments/track-selection",
            "body": {
              "mode": "raw",
              "raw": "{\n  \"track\": \"HexaFitness\"\n}"
            }
          }
        },
        {
          "name": "Submit Payout KYC",
          "request": {
            "method": "POST",
            "url": "{{baseUrl}}/api/client/payments/kyc",
            "body": {
              "mode": "formdata",
              "formdata": [
                { "key": "brCertificate", "type": "file", "src": [] },
                { "key": "bankProof", "type": "file", "src": [] }
              ]
            }
          }
        },
        { "name": "Get KYC Status", "request": { "method": "GET", "url": "{{baseUrl}}/api/client/payments/kyc/status" } },
        { "name": "Get Wallet", "request": { "method": "GET", "url": "{{baseUrl}}/api/client/payments/wallet" } },
        { "name": "Get Payout Schedule", "request": { "method": "GET", "url": "{{baseUrl}}/api/client/payments/payout-schedule" } }
      ]
    },
    {
      "name": "Admin - Onboarding Approval Queue",
      "item": [
        {
          "name": "List Onboarding Requests",
          "request": { "method": "GET", "url": "{{baseUrl}}/api/admin/onboarding-requests?status=New&search=&page=1&pageSize=20" }
        },
        { "name": "Get Onboarding Request By Id", "request": { "method": "GET", "url": "{{baseUrl}}/api/admin/onboarding-requests/{{onboardingRequestId}}" } },
        {
          "name": "Update Onboarding Status (Called)",
          "request": {
            "method": "PATCH",
            "header": [{ "key": "Content-Type", "value": "application/json" }],
            "url": "{{baseUrl}}/api/admin/onboarding-requests/{{onboardingRequestId}}/status",
            "body": { "mode": "raw", "raw": "{\n  \"status\": \"Called\"\n}" }
          }
        },
        {
          "name": "Update Onboarding Status (Approved)",
          "request": {
            "method": "PATCH",
            "header": [{ "key": "Content-Type", "value": "application/json" }],
            "url": "{{baseUrl}}/api/admin/onboarding-requests/{{onboardingRequestId}}/status",
            "body": { "mode": "raw", "raw": "{\n  \"status\": \"Approved\"\n}" },
            "description": "On success, onboardingRequestId also becomes a valid {{activationToken}} for the Client - Activation folder."
          }
        },
        {
          "name": "Update Onboarding Status (Rejected)",
          "request": {
            "method": "PATCH",
            "header": [{ "key": "Content-Type", "value": "application/json" }],
            "url": "{{baseUrl}}/api/admin/onboarding-requests/{{onboardingRequestId}}/status",
            "body": { "mode": "raw", "raw": "{\n  \"status\": \"Rejected\",\n  \"reason\": \"Duplicate submission\"\n}" }
          }
        },
        {
          "name": "Resend Activation Link",
          "request": { "method": "POST", "url": "{{baseUrl}}/api/admin/onboarding-requests/{{onboardingRequestId}}/resend-activation-link" }
        }
      ]
    },
    {
      "name": "Admin - Payout KYC Review",
      "item": [
        { "name": "List Payout KYC (Pending)", "request": { "method": "GET", "url": "{{baseUrl}}/api/admin/payout-kyc?status=Pending" } },
        { "name": "Get Payout KYC By Client Id", "request": { "method": "GET", "url": "{{baseUrl}}/api/admin/payout-kyc/{{clientId}}" } },
        {
          "name": "Review Payout KYC (Approve)",
          "request": {
            "method": "PATCH",
            "header": [{ "key": "Content-Type", "value": "application/json" }],
            "url": "{{baseUrl}}/api/admin/payout-kyc/{{clientId}}/status",
            "body": { "mode": "raw", "raw": "{\n  \"status\": \"Approved\"\n}" }
          }
        },
        {
          "name": "Review Payout KYC (Reject)",
          "request": {
            "method": "PATCH",
            "header": [{ "key": "Content-Type", "value": "application/json" }],
            "url": "{{baseUrl}}/api/admin/payout-kyc/{{clientId}}/status",
            "body": { "mode": "raw", "raw": "{\n  \"status\": \"Rejected\",\n  \"reason\": \"Bank proof illegible\"\n}" }
          }
        }
      ]
    },
    {
      "name": "Admin - Client Directory",
      "item": [
        { "name": "List Clients", "request": { "method": "GET", "url": "{{baseUrl}}/api/admin/clients?search=&page=1&pageSize=20" } },
        { "name": "Get Client By Id", "request": { "method": "GET", "url": "{{baseUrl}}/api/admin/clients/{{clientId}}" } }
      ]
    }
  ]
}