🔌 API Reference Overview

The MudraHQ REST API provides programmatic access to your business invoicing, products, customer ledgers, and tax compliance data.

🌐 Base URL & Endpoints

🔐 Authentication

All private endpoints require a JSON Web Token (JWT) transmitted via the standard Authorization HTTP header:

Authorization: Bearer <your_jwt_token>

Tokens are obtained by authenticating against POST /api/auth/login or POST /api/auth/google. Tokens are valid for 7 days.

⚡ Rate Limiting & Security Safeguards

To protect against credential stuffing and brute force attempts:

• /api/auth/login is guarded by a sliding-window rate limiter allowing up to 5 failed attempts per IP per 15-minute window.
• All endpoints enforce a strict 1MB request body limit (HTTP 413 Payload Too Large on violation).
• Cross-Origin Resource Sharing (CORS) is strictly restricted to trusted platform domains (*.mudrahq.tech).

📦 Standard API Response Envelope

Successful requests return standard JSON envelopes:

{  "success": true,  "data": { ... },  "message": "Operation completed successfully"}

Errors return clear HTTP status codes and diagnostic error messages:

{  "error": "Invalid credentials",  "statusCode": 401}