Skip to main content
The LaraCopilot API uses server-side session authentication. Send credentials to the login endpoint to establish a session, then include the session cookie on all subsequent requests. Endpoints that require authentication return 401 Unauthorized when no valid session exists. The logout endpoint destroys the session, and GET /api/admin/me lets you inspect the currently authenticated user at any time.

​
POST /api/admin/login

Validates the provided credentials and creates a new admin session. Returns the authenticated user’s name, email, and role on success, or a 422 error when credentials do not match.
​
email
string
required
The email address of the admin account. Must be a valid email format.
​
password
string
required
The plaintext password for the account.
​
message
string
A human-readable status message. Value is "Login successful." on success.
​
data
object
The authenticated user object.
Error responses
StatusCondition
422Credentials do not match any known user. Body: {"message": "Invalid credentials."}
curl -X POST https://your-instance.laracopilot.com/api/admin/login \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -c cookies.txt \
  -d '{
    "email": "admin@business.com",
    "password": "admin123"
  }'

​
POST /api/admin/logout

Destroys the current admin session. No request body is required. The endpoint always returns 200 regardless of whether a session was active.
​
message
string
Confirmation string. Value is "Logged out successfully.".
curl -X POST https://your-instance.laracopilot.com/api/admin/logout \
  -H "Accept: application/json" \
  -b cookies.txt

​
GET /api/admin/me

Returns the user data stored in the current session. Use this endpoint to verify that a session cookie is still valid or to retrieve the logged-in user’s identity without re-authenticating.
​
message
string
A human-readable status message. Value is "Authenticated user loaded." on success.
​
data
object
Session user data.
Error responses
StatusCondition
401No active session found. Body: {"message": "Unauthorized."}
curl https://your-instance.laracopilot.com/api/admin/me \
  -H "Accept: application/json" \
  -b cookies.txt