Admin auth

Email + password login for the back-office panel and token revocation. Paths are relative to the /api/v1 prefix; login is the one public admin endpoint, and the token it returns guards every other /admin/* route.

POST /admin/auth/login is public (rate-limited to 10 requests / minute). Every other admin endpoint requires Authorization: Bearer {token}. Admin only.

See Common errors.

Endpoints

Method	URI	Access	Description
`POST`	`/admin/auth/login`	Public	Exchange email + password for an admin token
`POST`	`/admin/auth/logout`	Admin	Revoke the current admin token

POST /admin/auth/login

Authenticates an active admin and issues a bearer token. Inactive admins are treated as non-existent.

Request body

Field	Type	Required	Rules
`email`	string	yes	valid email
`password`	string	yes	non-empty

Response 200

{
  "token": "12|abc...",
  "admin": {
    "id": 1,
    "name": "Ops Caracas",
    "email": "ops@aguita.app",
    "isSuperAdmin": false
  }
}

Errors

Status	Body	When
`401`	`{ "error": "InvalidCredentials" }`	Unknown email, wrong password, or the admin is inactive

POST /admin/auth/logout

Revokes the bearer token used for the request.

Response 200

{ "ok": true }