BIO.RE Developer Portal
Self-service API documentation for the BIO.RE platform — auth, content, payments, messaging, real-time, and more. Build frontends and mobile apps without asking the backend team.
The BIO.RE Developer Portal documents every public + user-authenticated + admin-managed endpoint of the BIO.RE creator monetization platform. It is the single source of truth for client-web, admin-v2, and mobile teams — every endpoint is verified against the live backend (5-source: controller + DTO + service + Prisma + live response).
Quick start
Authentication
Register, login, OAuth, 2FA, password reset, sessions — everything to get a user signed in.
Try it live
Each endpoint has a built-in interactive playground. Authenticate against staging and inspect real responses.
How the portal is organized
- 🌐 Public — auth-free endpoints (register, content, discover, locales, legal, theme).
- 🔑 User-auth — JWT bearer required (profile, wallet, messages, sessions, creator-only endpoints).
- 👤 Admin — admin-managed surfaces (config, users, content authoring, providers, trust-safety) — exposed for transparency; client apps consume the public/user side, while admin tooling consumes admin endpoints.
- 🧪 Dev tools — provider test endpoints (mail, SMS, push, captcha, KYC, payment) for staging-only debugging.
- 🔌 WebSocket events — chat-service real-time event surface (typing, presence, message:new, read receipts).
Reading an endpoint page
Every endpoint page follows the same shape:
- Header — method + path + scope badge + rate limit + captcha note.
- Request — headers + body schema (with
class-validatorrules preserved). - Response — success envelope + every error code with i18nKey.
- Side effects — DB writes, queued jobs, audit log entries, kill-switch checks.
- Code samples —
curl+TypeScript fetch+TanStack Queryhook (copy-paste ready). - Try it — interactive playground with auto-generated cURL/JS/Go/Python/Java/C# samples.
- Source —
path:linereferences back to the backend code (5-source verify).
Conventions
- Response envelope — every successful response is
{ "success": true, "data": T }. Errors are{ "success": false, "error": { code, message, i18nKey?, details?, correlationId } }. - Refresh tokens — set as
httpOnly,secure,SameSite=Strictcookie scoped to.bio.re. Browsers send + receive automatically; mobile clients can pass via body. - Idempotency — mutating endpoints accept
Idempotency-Keyheader (where supported); side effects table notes which writes are atomic. - Locales — 20 active locales (
packages/i18n/locales/<locale>/*.json); error responses includei18nKeyfor UI mapping. - Admin-managed data — endpoints that read admin-configured values (i18n, content, providers, theme) are flagged at the top.
- Admin-managed providers — every external integration (email, SMS, push, captcha, KYC, payment, OAuth, storage) is selected by admin at runtime. The portal never names the active vendor (e.g., "SendGrid" / "Twilio" / "Stripe"); endpoints reference the abstraction (
external.email.active_provider,external.captcha.active_provider, etc.). Frontend reads the abstract token; the backend resolves to whichever vendor is currently active. Vendor today ≠ vendor tomorrow.
Where to start
| If you are building... | Start here |
|---|---|
| Sign-up + login flow | Register → Verify Email → Login |
| Forgotten password flow | Forgot Password → Reset Password |
| Two-factor authentication | Login with 2FA (rest of 2FA endpoints WIP) |
| Account dashboard | Current User Identity, List Active Sessions, Change Password |
| Token rotation | Refresh Access Token |
More modules (content, discover, payments, messaging, creator, real-time) coming online as the portal expands.