Manual API sandbox
Contract v1 · Foundation pilot. This API saves data inside private, temporary workspaces. The older /api/users API remains a simulation.
Base: https://testkru.com/api/manual/v1. Download the OpenAPI contract.
Deployment readiness
GET /health is a read-only check. A configured API with its tables in place returns 200 and {"status":"ok","apiVersion":1}. It returns 503 when configuration, storage, or migration is incomplete. HEAD /health returns the same status without a body.
Get started
Create your workspace in the CodeKru course. The console attaches its workspace capability automatically. Log in using a practice actor, then manually copy the returned access token into Authorization: Bearer TOKEN.
POST /auth/login
Content-Type: application/json
{"username":"a","password":"practice-a"}Other dummy accounts: b / practice-b and support / practice-support. Never use your CodeKru account password here. Access tokens expire after 15 minutes. A reset invalidates all old tokens and restores the seed data.
Endpoints
| Method and path | Behavior |
|---|
| GET /workspace | Workspace generation, scenario and expiry. Workspace token required. |
| POST /auth/login | Practice token, refreshToken, actor, expiresIn. |
| GET /auth/me | Authenticated actor and role. |
| POST /auth/refresh | Send refreshToken in JSON. Rotation invalidates the previous access and refresh tokens. |
| POST /auth/logout | Send {} with actor authorization. Revokes this session; 204. |
| GET /customers | Visible records in data array, with meta.total. |
| POST /customers | Create customer; 201 with persisted record. |
| GET /customers/{id} | Read customer; 200, or 404 if absent or owned by another actor. |
| PUT /customers/{id} | Replace customer. Omitted optional fields become null. |
| PATCH /customers/{id} | Update supplied fields. Omitted fields remain unchanged. |
| DELETE /customers/{id} | Delete; 204. Subsequent read/delete returns 404. |
Customer rules
- name: required, trimmed, 1–80 Unicode code points.
- email: required, valid syntax, trimmed and lowercased. Unique per workspace; duplicate returns 409 EMAIL_EXISTS.
- age: optional integer 18–120, or null.
- city: optional string of at most 320 bytes, or null.
- id and owner: read-only. Unknown properties are rejected.
Access rules
A and B can read and write only their own records. Support can read every record within this workspace but cannot write. A rejected mutation does not partially change the record. Unauthenticated requests return 401; forbidden support writes return 403. Foreign-owned records return 404 to avoid disclosing their existence.
Lifetime and limits
Seven days per workspace. Reset deletes current practice data. Limits: 60 requests/minute/workspace, 100 customers, 100 sessions. HTTP 429 includes Retry-After. The course console also applies per-user limits.
Errors
{"error":{"code":"EMAIL_EXISTS","message":"A customer with this normalized email already exists."}}X-Request-Id identifies each response. Only synthetic practice data belongs in this sandbox.