API Overview

External API surface

Production base URL: https://backend.biotech-mkt.com. A complete request URL consists of this base URL plus the endpoint path, and every endpoint page displays the complete URL directly.

The three authentication endpoints are fixed public paths and are not registered in Endpoint Management. Although the two protected endpoints are published in code, they must still be registered, enabled, and granted to the current application.

Request conventions

• The production base URL is https://backend.biotech-mkt.com; ask the platform administrator for non-production base URLs.
• JSON requests use Content-Type: application/json.
• Protected endpoints should use Authorization: Bearer <access_token>.
• Paths are normalized without a trailing slash before exact matching; the HTTP method must be correct.
• Access Tokens are not accepted in URL query parameters.

Successful response

{
  "code": 200,
  "message": "Success",
  "data": {}
}

Successful protected responses also include:

• X-Request-Id
• X-RateLimit-Status
• QPS and 30-day quota headers when rate limiting is enabled

Error response

{
  "code": 401,
  "message": "access_token has expired",
  "data": []
}

Clients should inspect both the HTTP status and response code, and retain X-Request-Id so administrators can find the request in the audit log. Do not branch application logic on message text.

Protected endpoint validation order

The server processes a protected request in this order:

1. Validate the Access Token and application status.
2. Verify that the endpoint is published by code.
3. Verify endpoint registration and the application grant.
4. Consume the application-and-endpoint rate-limit quota.
5. Execute the business controller.

The same path can therefore return different status codes depending on whether the request fails during authentication, publication, authorization, or rate limiting. See Errors and Rate Limits.