# REST API Reference

Base URL: `https://emimobilelock.lovableultimate.shop/API/`
All requests/responses are JSON. Authenticated endpoints require
`Authorization: Bearer <jwt>`.

| Endpoint | Method | Auth | Body | Description |
|----------|--------|------|------|-------------|
| `login.php` | POST | none | `{email,password}` | Admin login → `{token}` |
| `logout.php` | POST | any | – | Log out (audit) |
| `register_device.php` | POST | none | device fields | Enroll/refresh device → `{device_id,token}` |
| `heartbeat.php` | POST | device | – | Mark online → `{pending_commands}` |
| `sync_device.php` | POST | device | status fields | Push battery/RAM/storage/network |
| `battery_update.php` | POST | device | `{battery_level,charging}` | Battery-only update |
| `location_update.php` | POST | device | `{latitude,longitude,accuracy}` | Push GPS |
| `device_status.php` | GET | any | `?device_id=` | Latest device + status |
| `command_fetch.php` | GET | device | – | Pull pending commands (marks sent) |
| `command_response.php` | POST | device | `{command_id,success,result}` | Report command result |
| `notification.php` | GET/POST | any/admin | – / `{device_id,title,body}` | List / send notifications |

## Command types
`lock`, `unlock`, `refresh`, `wallpaper`, `notify`, `install_app`,
`update_app`, `remove_app`, `wifi_config`, `password_policy`, `factory_reset`.

## Auth model
- **Admin token**: `type=admin`, issued by `login.php`.
- **Device token**: `type=device`, issued by `register_device.php`.
JWT is HS256-signed with the server secret and expires in 7 days.