# API Reference

All AJAX endpoints live in `/api`. For POST requests, send `csrf_token` or `X-CSRF-TOKEN`.

Important endpoints:
- `cart.php`, `checkout.php`, `product-search.php`, `reward-preview.php`, `location.php`
- `wishlist.php`, `compare.php`, `coupon.php`, `shipping-quote.php`, `reward-redeem.php`
- `wallet-transfer.php`, `withdraw-request.php`, `otp-send.php`, `otp-verify.php`
- `affiliate-plan.php`, `member-product-select.php`, `team-tree.php`
- `export.php` and `report-export.php`

## Pro POS API endpoints

### `GET api/pos-product-search.php`
Query params:
- `q` — product name/SKU/barcode search.
- `code` — exact barcode/SKU/product-code lookup.
- `vendor_id` — optional vendor scope.

### `POST api/pos-checkout.php`
Completes a POS sale. Requires CSRF header and POS role access.
Payload fields include `vendor_id`, `register_id`, `shift_id`, `items`, `discount_amount`, `tax_percent`, `customer_id` and `payments`.

### `POST api/pos-held-sales.php`
Actions: `hold`, `delete`. Stores suspended carts in `pos_held_sales`.

### `POST api/pos-shift.php`
Actions: `open`, `close`, `cash_movement`.

### `POST api/pos-refund.php`
Creates refund records from `sale_no`, `amount`, `method` and `reason`.

### `POST api/pos-sync.php`
Accepts offline queue payloads with a client UUID and syncs sales using duplicate protection.

### `GET/POST api/pos-customer.php`
Searches or creates walk-in POS customers.

### `GET api/pos-receipt.php`
Returns receipt JSON for sale receipt previews and custom print integrations.

### `POST api/pos-scan-log.php`
Stores scanner events for audit/debugging of barcode machines and camera scanning.

### `GET/POST api/pos-settings.php`
Returns or saves vendor POS scanner, printer, payment and offline settings.
