Admin API

The package mounts a management API under /internal/admin/v1/, behind the boilerplate admin stack when it’s present (or a Sanctum-authenticated stack on a plain Laravel app — see Configuration). No routes need to be added by hand.

Endpoints

All paths are prefixed with /internal/admin/v1.

Method	Endpoint	Name	Description
GET	/coupons	admin.coupons.index	List coupons (type, is_active, search, per_page)
POST	/coupons	admin.coupons.store	Create a coupon
POST	/coupons/bulk	admin.coupons.bulk	Bulk-generate codes
GET	/coupons/{coupon}	admin.coupons.show	Coupon detail + redemptions_count
PATCH	/coupons/{coupon}	admin.coupons.update	Update name, is_active, restrictions
DELETE	/coupons/{coupon}	admin.coupons.destroy	Soft-delete (see force rule below)
PATCH	/coupons/{coupon}/activate	admin.coupons.activate	Set is_active = true
PATCH	/coupons/{coupon}/deactivate	admin.coupons.deactivate	Set is_active = false
GET	/coupons/{coupon}/redemptions	admin.coupons.redemptions	Redemptions for one coupon
GET	/coupon-redemptions	admin.coupon-redemptions.index	Global redemption list

Responses use the standard API envelope; paginated lists return the { data, meta, links } shape.

Create a coupon

curl -X POST https://your-app/internal/admin/v1/coupons \
  -H 'Accept: application/json' -H 'Authorization: Bearer <admin-token>' \
  -H 'Content-Type: application/json' \
  -d '{
    "code": "LAUNCH20",
    "name": "Launch promotion — 20% off",
    "type": "percent_off",
    "value": { "percent": 20 },
    "restrictions": { "max_uses": 500, "per_user": 1, "expires_at": "2026-12-31T23:59:59Z" }
  }'

code is optional — omit it to auto-generate. Returns 201 with the coupon resource.

Bulk generation

curl -X POST https://your-app/internal/admin/v1/coupons/bulk \
  -H 'Authorization: Bearer <admin-token>' -H 'Content-Type: application/json' \
  -d '{ "quantity": 50, "prefix": "LAUNCH", "type": "free_months", "value": { "months": 1 } }'

Returns 201 with an array of the created code strings (not full resources, to keep the payload small).

Immutability & deletion rules

• type and value are immutable after creation. PATCH only accepts name, is_active and restrictions — this preserves the integrity of the redemption snapshot.
• Deletion is soft. Deleting a coupon that has redemptions requires ?force=true; without it the endpoint returns 422. Redemption history is always preserved.

Audit events

When the host provides the boilerplate’s audit_log() helper, admin mutations are recorded:

Event	Trigger
admin.coupon.created	Single coupon created
admin.coupon.bulk_created	Bulk generation completed (quantity in metadata)
admin.coupon.updated	Coupon fields updated
admin.coupon.deleted	Coupon soft-deleted
admin.coupon.activated / admin.coupon.deactivated	is_active toggled

On a standalone app without the helper, these calls are silently skipped.