Technical Documentation

API Reference

Quick search…⌘K

The Auto Glass REST API is a versioned HTTP JSON API served at https://api.autoglass.io/v1. All requests must include an Authorization: Bearer <token> header unless marked Public. All responses are application/json.

Base URL: Production: https://api.autoglass.io/v1 · Staging: https://api-staging.autoglass.io/v1 · All HTTPS only · TLS 1.3

Authentication

The API uses JWT Bearer tokens for authentication. Tokens are issued by the Auth Service and expire after 15 minutes. Refresh tokens are valid for 30 days and stored HTTP-only.

POST /v1/auth/login
Content-Type: application/json

{ "email": "user@example.com", "password": "•••••••••" }

→ 200 OK
{
  "accessToken":  "eyJhbGci...",
  "refreshToken": "eyJhbGci...",
  "expiresIn":    900,
  "user": { "id": "usr_01J...", "name": "Jane Smith", "role": "dispatcher" }
}

Request / Response Conventions

Convention	Detail
ID format	KSUID-based prefixed strings e.g. `bkg_01J9X...`, `wko_01J9X...`
Timestamps	ISO 8601 UTC, e.g. `2025-06-15T09:30:00Z`
Money/Amounts	Integers in cents (e.g. `15000` = $150.00 USD)
Pagination	Cursor-based: `?cursor=<id>&limit=25`
Error format	`{ error: string, code: string, field?: string}`
Idempotency	POST endpoints accept `Idempotency-Key` header (UUID)

HTTP Status Codes

Code	Meaning
`200`	Success with body
`201`	Resource created
`204`	Success, no body
`400`	Validation error — check `error.field`
`401`	Missing or expired JWT
`403`	Authenticated but insufficient role
`404`	Resource not found
`409`	Conflict (e.g. booking slot taken)
`422`	Business rule violation (e.g. booking window passed)
`429`	Rate limited — retry after `Retry-After` header
`503`	Downstream service unavailable (circuit open)

Rate Limits

Tier	Limit	Window
Anonymous / Public	30 requests	per minute per IP
Authenticated Customer	120 requests	per minute per user
Technician / Dispatcher	300 requests	per minute per user
Admin / Service Account	2,000 requests	per minute

Endpoint Reference

POST/v1/auth/loginAuth: Public

Authenticate user, return JWT access + refresh tokens

Body: { email, password }

Response: { accessToken, refreshToken, user }

POST/v1/auth/refreshAuth: Public

Exchange a refresh token for a new access token

Body: { refreshToken }

Response: { accessToken }

GET/v1/vehicles/decode/:vinAuth: Bearer

Decode a 17-character VIN via NHTSA + DataOne to retrieve year, make, model, trim, ADAS features, glass codes

Body: -

Response: { vin, year, make, model, adasFeatures[], glassIds[] }

POST/v1/quotesAuth: Bearer

Generate a real-time glass replacement quote with NAGS pricing, ADAS surcharge, and mobile fee

Body: { vin, serviceType, zipCode, insuranceId? }

Response: { quoteId, lineItems[], total, adasRequired, validUntil }

GET/v1/quotes/:idAuth: Bearer

Retrieve a previously generated quote by ID

Body: -

Response: Quote object

POST/v1/bookingsAuth: Bearer

Convert an accepted quote into a confirmed booking with scheduled appointment

Body: { quoteId, appointmentSlot, location, paymentMethodId }

Response: { bookingId, confirmationCode, technicianId, eta }

GET/v1/bookings/:idAuth: Bearer

Retrieve booking details including real-time technician ETA

Body: -

Response: Booking object with live ETA

PATCH/v1/bookings/:id/cancelAuth: Bearer

Cancel a booking (refund if > 2 hours before appointment)

Body: { reason }

Response: { status, refundAmount }

GET/v1/dispatch/available-slotsAuth: Bearer

Return available appointment slots for a zip code in the next 14 days

Body: -

Response: { slots[] }

POST/v1/work-ordersAuth: Technician

Create a work order for an assigned booking (triggered by Dispatch Engine)

Body: { bookingId, technicianId, partsChecklist[] }

Response: WorkOrder object

PATCH/v1/work-orders/:id/completeAuth: Technician

Mark work order complete, upload photos, attach calibration certificate

Body: { photos[], calibrationCertUrl?, signatureDataUrl }

Response: { invoiceId, status }

POST/v1/insurance/claimsAuth: Bearer

Submit an insurance claim for a completed work order via EDI

Body: { workOrderId, policyNumber, insurerId }

Response: { claimId, claimStatus, expectedReimbursement }

GET/v1/insurance/claims/:idAuth: Bearer

Check status of a submitted insurance claim

Body: -

Response: { claimId, status, adjudicationNotes, reimbursedAmount }

POST/v1/payments/intentAuth: Bearer

Create a Stripe Payment Intent for customer co-pay or direct payment

Body: { bookingId, amount, currency }

Response: { clientSecret, paymentIntentId }

POST/v1/inventory/parts/scanAuth: Technician

Barcode scan a part to log it against a work order and decrement van stock

Body: { barcode, workOrderId }

Response: { partId, partName, qty, vanStockRemaining }

POST/v1/calibration/sessionsAuth: Technician

Log ADAS calibration session with target type, results, and pass/fail status

Body: { workOrderId, calibrationType, targetData, passedCalibration }

Response: { sessionId, certificateUrl }

GET/v1/technicians/:id/locationAuth: Dispatcher

Get real-time GPS location of a technician (Redis Geo)

Body: -

Response: { lat, lng, speed, updatedAt }

Webhooks

Configure webhook endpoints in the Admin Portal. All events POST to your URL with a X-AutoGlass-Signature HMAC-SHA256 header for verification.

Event	Trigger
`booking.created`	New booking confirmed
`booking.cancelled`	Booking cancelled by customer or ops
`technician.en_route`	Technician departed for appointment
`work_order.completed`	Technician marked job complete
`invoice.issued`	Invoice PDF generated
`payment.succeeded`	Payment captured successfully
`claim.approved`	Insurance claim adjudicated and approved
`claim.rejected`	Insurance claim denied with reason code