# API Overview

Current external endpoints, authentication requirements, and common response conventions.

## External API surface

Production base URL: `https://backend.biotech-mkt.com`. A complete request URL consists of this base URL plus the endpoint path, and every endpoint page displays the complete URL directly.

| Method | Path                                                | Access Token | Description                                           |
| ------ | --------------------------------------------------- | ------------ | ----------------------------------------------------- |
| `POST` | `/openapi/auth/token`                               | Not required | Exchange an App Key and App Secret for tokens         |
| `POST` | `/openapi/auth/refresh`                             | Not required | Rotate tokens using a Refresh Token                   |
| `POST` | `/openapi/auth/revoke`                              | Not required | Revoke the token record identified by a Refresh Token |
| `GET`  | `/openapi/profile`                                  | Required     | Retrieve the current application and token context    |
| `GET`  | `/openapi/v1/doudian/order/union-settlement-orders` | Required     | List Douyin Selected Alliance settlement orders       |

The three authentication endpoints are fixed public paths and are not registered in Endpoint Management. Although the two protected endpoints are published in code, they must still be registered, enabled, and granted to the current application.

## Request conventions

- The production base URL is `https://backend.biotech-mkt.com`; ask the platform administrator for non-production base URLs.
- JSON requests use `Content-Type: application/json`.
- Protected endpoints should use `Authorization: Bearer <access_token>`.
- Paths are normalized without a trailing slash before exact matching; the HTTP method must be correct.
- Access Tokens are not accepted in URL query parameters.

## Successful response

```json
{
  "code": 200,
  "message": "Success",
  "data": {}
}
```

Successful protected responses also include:

- `X-Request-Id`
- `X-RateLimit-Status`
- QPS and 30-day quota headers when rate limiting is enabled

## Error response

```json
{
  "code": 401,
  "message": "access_token has expired",
  "data": []
}
```

Clients should inspect both the HTTP status and response `code`, and retain `X-Request-Id` so administrators can find the request in the audit log. Do not branch application logic on `message` text.

## Protected endpoint validation order

The server processes a protected request in this order:

1. Validate the Access Token and application status.
2. Verify that the endpoint is published by code.
3. Verify endpoint registration and the application grant.
4. Consume the application-and-endpoint rate-limit quota.
5. Execute the business controller.

The same path can therefore return different status codes depending on whether the request fails during authentication, publication, authorization, or rate limiting. See [Errors and Rate Limits](/en/guides/errors-rate-limits).