Admin API

The WiseLoop framework uses a two-tier model — public controllers on an allowlist, and admin* controllers requiring an authenticated admin session via wlRestTriggerAuth. Role checks (super_admin, svc_rep) are enforced per action via RPM\Api\AdminAuthGuard.

What this means in practice: Website integrations continue using public endpoints (e.g. /API/vrProperties/V1/vrProperties.json). Server-to-server admin integrations call /API/auth/V1/login.json first, then access admin* endpoints with the session cookie. Landlords (adminRole=1, not superuser) may read their own properties, invoices, reservations, expenses, and tenants via API but cannot POST, PUT, or DELETE. Housekeepers have no admin API data access.

When admin-protected endpoints are added, this is how authentication works:

// 1. Login — establishes wlSession with admin data
POST /API/auth/V1/login.json
Content-Type: application/json

{
  "adminAPIKey": "your-api-key",
  "adminAPISecret": "your-api-secret"
}

// Response (session cookie set):
{
  "adminId": 1,
  "adminFirstName": "Jane",
  "adminLastName": "Admin",
  "adminRole": "0",
  "superuser": "1"
}

// 2. Verify session
GET /API/auth/V1/user.json
// or single field:
GET /API/auth/V1/user/adminEmail.json

// 3. Logout
POST /API/auth/V1/logout.json

The session is managed by WiseLoop wlSession (key: wlAuthData). Requests to non-public admin* controllers require this session cookie. Per-action role checks return 403 Forbidden when the admin role is not allowed.

Write actions log to activityLog via rpm_admin_activity_log_service() on every successful POST/PUT.

Full request/response field reference: API Reference — Admin sections.

Phase 4 shipped write endpoints. Phase 5 (v5.9.3.3) completed optional admin surface:

Each new controller should:

1. Be registered in API/index.html
2. Not appear in MySqlAuthHandler public allowlist
3. Delegate to existing PSR-4 services (thin controller pattern)
4. Check adminRole / superuser for action-level authorization
5. Use prepared statements and match systemDocuments/myAdmin/coding-standards.md

These files exist in API/ but are not registered in API/index.html. They contain SQL injection patterns and should not be enabled without a full security rewrite:

• API-001 (fixed): Public allowlist default-denies unknown controllers; admin* controllers require session.
• Role enforcement: AdminAuthGuard::requireRole() maps adminRole/superuser to super_admin, svc_rep, etc.
• Credential storage: adminAPISecret is plain text in DB — consider hashing before Phase 3 write endpoints.
• Separate auth domains: Tenant session (publicAuth), admin portal session (myAdmin), and REST admin session (wlSession) are three independent mechanisms.
• Integration scripts (Stripe, QuickBooks, BookingPal) use their own auth — not the wlRest admin auth. See Integration Scripts.