REST API

Base URL

• Production: https://api.voke.lovinka.com
• Development: http://localhost:4410

All endpoints are URI-versioned under /api/v1.

Authentication

Voke supports two auth modes:

• Bearer token — standard Authorization: Bearer <token> header. Used by partner integrations and the mobile app.
• httpOnly cookie — issued by POST /auth/login. Used by the admin SPA. Not typically used by integrators.

An additional header is required for any org-scoped operation:

• x-org-id: <organization-uuid> — pinned organization context. In the admin SPA this is read from voke:current-org; integrators should pass the organization UUID they intend to operate in.

Error envelope

Every 4xx/5xx returns:

{
  "statusCode": 400,
  "message": "human-readable summary",
  "error": "Bad Request",
  "code": "DEVICE_TEMPLATE_SIGNAL_INVALID",
  "details": ["signals.0.bit: must be an integer >= 0"]
}

The code field is the stable machine-readable contract — see Error Codes.

Pagination

List endpoints use page + limit query params (defaults: page=1, limit=20, max limit=100) and return:

{
  "data": [...],
  "meta": {
    "page": 1,
    "limit": 20,
    "total": 123,
    "totalPages": 7
  }
}

Endpoint reference

Endpoint pages below are auto-generated from the Voke OpenAPI spec. Each page groups endpoints by @ApiTags.