A direct line to the city.

Start with a public request.

Read public information before adding credentials. Responses use JSON and a status field. The production API runs on PHP and shares the same account permissions as the website.

GET /backend/api/index.php?endpoint=core/metrics

Use this browser example from the same origin:

const response = await fetch('/backend/api/index.php?endpoint=core/metrics');
const result = await response.json();
if (!response.ok || result.status === 'error') {
  throw new Error(result.message || 'Request failed');
}
console.log(result.metrics);

Use a real identity.

Browser requests use the signed-in session. External integrations must use a credential issued for their account and the permissions it grants. Keep credentials on your server; never put secrets in public source code.

Authorization: Bearer YOUR_ISSUED_TOKEN
Content-Type: application/json

Write requests use POST. A credential does not bypass role checks, rate limits, or private-content permissions.

Explore the available endpoints.

Build for failure as well as success.

Check the HTTP status and JSON status before using a response. Show a useful retry state for temporary errors, respect 429 rate limits, and send the user back to sign-in if their session expires. Never retry a payment or another irreversible operation without its documented idempotency mechanism.