Authentication
/api/v1/auth
Representative endpoints
- POST /register
- POST /login
- POST /refresh-token
- POST /logout
- POST /verify-email
- POST /forgot-password
- POST /reset-password
Patterns
FacadeStrategyObserver
API design
Versioned REST APIs with Swagger docs
Every module is exposed under /api/v1 with Jakarta Validation request DTOs, generic API responses, OpenAPI documentation, and role-based authorization.
User
/api/v1/users
Representative endpoints
- GET /me
- PATCH /me
- POST /me/avatar
- GET /addresses
- POST /addresses
- PATCH /preferences
- GET /favorites/restaurants
Patterns
RepositoryBuilder
Restaurant
/api/v1/restaurants
Representative endpoints
- GET /
- POST /
- GET /{id}
- PATCH /{id}
- POST /{id}/verify
- PATCH /{id}/status
- POST /{id}/images
Patterns
SpecificationFactory
Menu
/api/v1/menu
Representative endpoints
- GET /restaurants/{restaurantId}/items
- POST /categories
- POST /items
- PATCH /items/{id}
- POST /items/{id}/variants
- POST /items/{id}/addons
- PATCH /inventory/{id}
Patterns
BuilderFactory
Cart
/api/v1/cart
Representative endpoints
- GET /
- POST /items
- PATCH /items/{id}
- DELETE /items/{id}
- POST /coupon
- POST /reward-points
- POST /validate
Patterns
FacadeTemplate Method
Order
/api/v1/orders
Representative endpoints
- POST /
- GET /{id}
- GET /history
- PATCH /{id}/status
- POST /{id}/cancel
- POST /{id}/refund
- GET /{id}/tracking
Patterns
ObserverStateFactory
Delivery
/api/v1/deliveries
Representative endpoints
- POST /drivers
- POST /vehicles
- PATCH /drivers/location
- GET /nearby-orders
- POST /{id}/accept
- POST /{id}/reject
- PATCH /{id}/status
Patterns
StrategyAdapter
Payment
/api/v1/payments
Representative endpoints
- POST /intent
- POST /verify
- POST /wallet
- POST /refunds
- GET /history
- POST /webhooks/stripe
- POST /webhooks/razorpay
Patterns
StrategyAdapterFactory
Coupon
/api/v1/coupons
Representative endpoints
- GET /
- POST /
- GET /validate
- PATCH /{id}
- DELETE /{id}
- GET /usage
Patterns
SpecificationStrategy
Wallet
/api/v1/wallet
Representative endpoints
- GET /
- POST /recharge
- POST /debit
- POST /credit
- GET /transactions
- POST /cashback
Patterns
Template Method
Review
/api/v1/reviews
Representative endpoints
- POST /
- GET /restaurant/{id}
- GET /food/{id}
- POST /{id}/images
- POST /{id}/like
- POST /{id}/report
Patterns
Observer
Notification
/api/v1/notifications
Representative endpoints
- GET /
- PATCH /{id}/read
- POST /preferences
- POST /test-email
- POST /broadcast
Patterns
ObserverAdapter
Search
/api/v1/search
Representative endpoints
- GET /restaurants
- GET /foods
- GET /suggestions
- GET /nearby
- GET /popular
Patterns
Specification
Admin
/api/v1/admin
Representative endpoints
- GET /dashboard
- GET /analytics/revenue
- GET /users
- POST /restaurants/{id}/approve
- POST /drivers/{id}/approve
- GET /audit-logs
- GET /reports/export
Patterns
Facade
Analytics
/api/v1/analytics
Representative endpoints
- GET /top-restaurants
- GET /top-foods
- GET /revenue
- GET /monthly-sales
- GET /customers/growth
- GET /delivery/performance
- GET /cancellations
Patterns
RepositorySpecification
Security and response standards
JWT access tokens signed with asymmetric keys and validated by Spring OAuth2 Resource Server.
Refresh tokens are stored hashed, rotated on every use, device-scoped, and revocable.
Role-based and permission-based authorization through @PreAuthorize and SecurityFilterChain.
BCrypt or Argon2 password encoder with account locking after repeated failures.
CORS uses explicit frontend origins; CSRF is disabled only for stateless JWT APIs.
Input validation with Jakarta Validation DTOs and global exception mapping.
SQL injection prevention through Spring Data JPA parameters and Specifications.
XSS protection with JSON-only APIs, sanitized CMS fields, and secure response headers.
Rate limiting at gateway or Bucket4j filter for auth, OTP, coupon validation, and webhooks.