backend-api

ASP.NET Core API that concentrates authentication, business operations, admin workflows, maintenance utilities, and health monitoring consumed by public and admin frontend modules.

Technical foundation

.NET 8 + ASP.NET Core controllers in backend/src/TuCreditoOnline.API/Controllers.
JWT authentication + role-based authorization (Admin, SuperAdmin).
Public and protected endpoints coexist for customer and admin experiences.
Controller methods delegate business logic to infrastructure/application services.

Controller domains and responsibilities

Controller	Base route	What it is responsible for
`AuthController`	`/api/auth`	Admin login and conditional user registration (first setup or admin-authorized creation).
`DashboardController`	`/api/dashboard`	KPI and distribution data for operations dashboard visualizations.
`CreditRequestsController`	`/api/creditrequests`	Creation and lifecycle management of credit request records.
`UsersController`	`/api/users`	Admin user lifecycle: search, create, update, delete, and password updates.
`CreditTypesController`	`/api/credittypes`	Credit product catalog consumed by calculator and admin catalog tools.
`ServicesController`	`/api/services`	Marketing/service cards shown on public pages and managed by admins.
`ContactMessagesController`	`/api/contactmessages`	Customer contact intake and admin follow-up workflow by status.
`BackupController`	`/api/backup`	Generate downloadable backups and report backup file inventory/status.
`HealthController`	`/api/health`	API + database health telemetry for uptime checks.

Detailed endpoint catalog (what each route does)

Method	Endpoint	Auth / Role	Used by	Behavior and purpose
`POST`	`/api/auth/login`	Public	`frontend-admin/login`	Validates credentials and returns JWT token + user profile payload.
`POST`	`/api/auth/register`	Conditional (public first setup, then admin only)	Admin operations / setup flows	Creates user accounts with guardrail: only open anonymously when there are no users yet.
`GET`	`/api/dashboard/stats`	Admin, SuperAdmin	`frontend-admin/dashboard`	Returns aggregated KPIs (requests, users, approved amount, monthly stats).
`GET`	`/api/dashboard/status-distribution`	Admin, SuperAdmin	`frontend-admin/dashboard`	Returns distribution counts/percentages by request status for charts.
`POST`	`/api/creditrequests`	Public	`frontend-public/calculator`	Creates a customer credit request and returns created resource payload.
`GET`	`/api/creditrequests`	Admin, SuperAdmin	`frontend-admin/credit-requests`	Lists all requests for operational review tables and counters.
`GET`	`/api/creditrequests/{id}`	Admin, SuperAdmin	`frontend-admin/credit-requests`	Returns one request detail for modal/detail-level inspection.
`GET`	`/api/creditrequests/status/{status}`	Admin, SuperAdmin	`frontend-admin/credit-requests`	Filters request list by workflow status segment.
`PATCH`	`/api/creditrequests/{id}/status`	Admin, SuperAdmin	Admin operations	Generic status update endpoint for approve/reject style transitions.
`POST`	`/api/creditrequests/{id}/approve`	Admin, SuperAdmin	`frontend-admin/credit-requests`	Approves request and stores approval remarks/financial details.
`POST`	`/api/creditrequests/{id}/reject`	Admin, SuperAdmin	`frontend-admin/credit-requests`	Rejects request and captures rejection remarks.
`GET`	`/api/users`	Admin, SuperAdmin	`frontend-admin/users`	Returns paginated users list with optional search query.
`GET`	`/api/users/{id}`	Admin, SuperAdmin	`frontend-admin/users`	Fetches one user profile by ID.
`POST`	`/api/users`	Admin, SuperAdmin	`frontend-admin/users`	Creates a new admin-side user account.
`PUT`	`/api/users/{id}`	Admin, SuperAdmin	`frontend-admin/users`	Updates user metadata, role, and status flags.
`DELETE`	`/api/users/{id}`	Admin, SuperAdmin	`frontend-admin/users`	Deletes user account record.
`POST`	`/api/users/change-password`	Admin, SuperAdmin	Admin operations	Changes password for a specific user ID.
`GET`	`/api/credittypes`	Public (filter optional)	`frontend-public/home`, `services`, `calculator`, `frontend-admin/credit-types`	Lists credit products; can be filtered by active status.
`GET`	`/api/credittypes/{id}`	Public	Public/Admin detail flows	Returns one credit type entity.
`POST`	`/api/credittypes`	Admin, SuperAdmin	`frontend-admin/credit-types`	Creates new credit type catalog item.
`PUT`	`/api/credittypes/{id}`	Admin, SuperAdmin	`frontend-admin/credit-types`	Updates existing credit type catalog item.
`DELETE`	`/api/credittypes/{id}`	Admin, SuperAdmin	`frontend-admin/credit-types`	Deletes credit type catalog item.
`GET`	`/api/services`	Public (filter optional)	`frontend-admin/services`, public marketing pages	Lists service cards, optionally filtered by active flag.
`GET`	`/api/services/{id}`	Public	Public/Admin detail flows	Returns one service catalog record.
`POST`	`/api/services`	Admin, SuperAdmin	`frontend-admin/services`	Creates service record shown in frontend marketing sections.
`PUT`	`/api/services/{id}`	Admin, SuperAdmin	`frontend-admin/services`	Updates service title, description, icon, and display order.
`DELETE`	`/api/services/{id}`	Admin, SuperAdmin	`frontend-admin/services`	Deletes service record.
`POST`	`/api/contactmessages`	Public	`frontend-public/contact`	Persists customer contact form submission and returns acknowledgment data.
`GET`	`/api/contactmessages`	Admin, SuperAdmin	`frontend-admin/messages`	Lists messages with optional status filter for inbox operations.
`GET`	`/api/contactmessages/{id}`	Admin, SuperAdmin	`frontend-admin/messages`	Returns one message for detailed handling.
`GET`	`/api/contactmessages/pending`	Admin, SuperAdmin	Admin operations	Returns only New/InProgress messages.
`GET`	`/api/contactmessages/stats`	Admin, SuperAdmin	Admin operations	Returns contact message KPI statistics by status/state.
`PATCH`	`/api/contactmessages/{id}/status`	Admin, SuperAdmin	`frontend-admin/messages`	Applies status transitions and stores optional admin notes.
`DELETE`	`/api/contactmessages/{id}`	Admin, SuperAdmin	`frontend-admin/messages`	Soft-deletes contact message record.
`GET`	`/api/backup/generate`	Admin, SuperAdmin	`frontend-admin/settings`	Generates ZIP backup file and streams it for download.
`GET`	`/api/backup/status`	Admin, SuperAdmin	`frontend-admin/settings`	Returns recent backup metadata and counts.
`GET`	`/api/health`	Public	Monitoring / ops	Returns API health state with database connectivity metrics and timestamps.