REST API v1

Base URL https://rifd.jusoor-tech.com/api/v1 · JSON · Bearer token (Sanctum, 30 days) · 60 requests/minute. Amounts are integer halalas (1 SAR = 100). The API applies exactly the same workflow and permissions as the web portals.

Method	Path	Who	Notes
POST	/login	all	email, password, device_name [, code]. Two-factor users get 202 {otp_required:true}; repeat with the e-mailed code.
POST	/logout	all	Revokes the current token.
GET	/me	all	User, role, portal, organization status.
GET	/lookups	public	Active categories and cities.
GET	/catalog	company	category_id, city_id filters. Price is this company's unit price.
GET	/requests	company · clinic · platform	Scoped to the caller's organization. ?status=
GET	/requests/{id}	company · clinic · platform	Employees, timeline, quotes, invoice.
POST	/requests	company	type=direct (service_id) or rfq (category_id, title); employees[] {name, id_number, nationality, phone, job_title}.
POST	/requests/{id}/accept\|reject\|schedule\|start	clinic	reject: reason · schedule: scheduled_at (ISO 8601).

Errors: 401 no/expired token · 403 role or organization not active · 404 not yours · 422 validation / workflow rule (message in errors) · 429 rate limit.