Fangate API

Appearance

Changelog ​

This changelog tracks backend-relevant changes that are now reflected in the Fangate developer documentation.

It is organized by confirmed implementation areas rather than guessed release names where exact release labeling was not available.

2026-06 media-level consent workflow ​

Consent creator tags and the consent-required flag moved from product-only to per-media scope. Product purchase and explore visibility still aggregate across all linked media.

Added / changed ​

  • media.is_should_consent — whether this upload requires a 2257 / creator-tag workflow.
  • consent_creator_tags.media_id — each tag/slot belongs to one media row; unique per (media_id, tagged_user_id).
  • products.is_should_consent — derived summary (true when any linked media requires consent); kept for backward-compatible API responses.
  • Admin → Uploads — consent status column is per media row, not shared across all files on a product.
  • Purchase / is_accessible — blocked when any linked media has open or blocking consent.

Client migration ​

  • Read media_id on consent creator tag resources; group tags by media for per-upload UI.
  • Do not assume one consent workflow covers every file on a multi-media product.
  • Product is_should_consent remains a quick summary flag but is no longer the source of truth for workflow state.

See Consent & adult content — Media-level consent workflow.

2026-06 decoupled media library & n:m product linking ​

Media is a first-class creator library entity. Products reference one or more library items through an n:m product_media pivot instead of owning duplicated media rows per sales link.

Added ​

  • GET / POST / PATCH / DELETE /api/media — library list (status, folder, unlinked filters), create from finalized upload session, update metadata/folder, delete when not linked to products.
  • POST /api/media/bulk — start multiple upload sessions in one call; finalize each session then POST /api/media per file.
  • POST /api/products/{product}/media / DELETE /api/products/{product}/media/{media} — attach and detach library media on an existing product.
  • product_media pivot — one media row can appear on multiple products; legacy media.product_id is kept in sync for backward compatibility.
  • POST /api/products — accepts media_ids[] to create a sellable link from existing library items (legacy upload_session_id and multipart upload remain supported).
  • upload_defaults on PATCH /api/user/{id} and GET /api/user — account-level presets (is_adult_content, is_downloadable, is_verif_age, default_price, folder_id) for bulk upload and product creation.
  • API keys: /api/media* routes use existing api-key:urls.read / api-key:urls.write abilities.

Changed ​

  • Product–media relationship is n:m via product_media (was one-to-many on media.product_id alone).
  • POST /api/products/{product}/price-links reuses existing media rows on the new product instead of duplicating storage paths.
  • Moderation stays on media rows (veriff_status); purchasability still evaluates linked media per product.

Client migration ​

  • Prefer library-first flows: upload → POST /api/media → create or attach with media_ids[].
  • Treat outbound webhook data.media_ids as an array of m_{id} strings — same contract as before, now backed by the pivot.
  • Legacy upload_session_id on POST /api/products continues to work as a compatibility shim.

Documentation ​

Notes ​

  • Backend ships in Fangate-backend (merged to dev; main via PR #397).
  • Regenerate OpenAPI after deploy if you rely on Swagger UI for the new /api/media operations.

2026-06 outbound partner webhooks ​

Third-party integrators can register HTTPS endpoints and receive real-time payment notifications from Fangate.

Added ​

  • POST / GET / PATCH / DELETE /api/webhooks — creator-authenticated CRUD for outbound webhook endpoints (HTTPS URL, event subscriptions, optional include_set_price).
  • Events (v1): payment.successful, payment.failed, payment.pending — dispatched asynchronously when transactions.payment_status changes; does not block payment processing.
  • Delivery: HMAC-SHA256 (X-Fangate-Signature), idempotency key (X-Fangate-Delivery-Id), up to 3 attempts with backoff 1 min → 5 min → 30 min; per-attempt delivery log in outbound_webhook_deliveries.
  • API keys: optional can_manage_webhooks → ability api-key:webhooks.manage for integrator automation.

Documentation ​

2026-05 master / sub-account linked creator accounts ​

Backend-owned directional account groups for the creator account switcher replace token-only trust for multi-account analytics.

Added / changed ​

  • account_group_members table — persistent master_user_id → child_user_id links (max 10 sub-accounts per linking account; unique per pair; same sub-account may join multiple masters).
  • account_group on POST /api/login, POST /api/register, GET /api/user, and POST /api/login/batch — role (standalone | master | sub_account | hybrid), optional master summary for pure sub_account, linked_accounts for accounts that linked others (master / hybrid).
  • GET / POST / DELETE /api/user/linked-accounts — list, link (sub-account credentials), and unlink (per master direction).
  • POST /api/user/linked-accounts/{childUserId}/session — Sanctum token for switching when the bearer directly linked that sub-account.
  • POST /api/dashboard/summary/aggregate — accounts with linked sub-accounts aggregate persisted links only; additional_tokens ignored for them; pure sub_account without own links gets 403 if it sends additional_tokens.

Client migration ​

  • Stop relying on storing multiple passwords/tokens alone to access the “connected set”.
  • Use account_group from login and linked-account APIs; call the session endpoint when switching into a linked sub-account.
  • Sub-account logins must not expose sibling accounts from another master’s group.
  • hybrid accounts may link their own sub-accounts and aggregate only their linked set.

See Account switcher frontend integration and implementation guide.

2026-05 account switcher and multi-account dashboard KPIs ​

Documentation and bundled OpenAPI (docs/public/openapi.json) now cover creator multi-session (account switcher) flows and aggregated dashboard KPIs across multiple bearer tokens.

Added / clarified ​

  • POST /api/login/batch — batch creator login (up to 10 accounts); returns sessions (each with user + token) and per-row failed entries; rate limited (creator-login-batch).
  • GET /api/user/sessions / DELETE /api/user/sessions/{tokenId} — list and revoke Sanctum app sessions (api tokens only; integration API keys fangate-api-key:* are excluded).
  • GET /api/dashboard/summary — documents extended fields: currency_unified, accounts[], and conditional root wallet_balance (see Wallet).
  • POST /api/dashboard/summary/aggregate — merge the same KPI payload across the authenticated creator plus optional additional_tokens (other creators’ api tokens); trust model and multi-currency behavior documented in Wallet.
  • Auth and Authentication — batch login, session list/revoke, and multi-account switching guidance for client teams.

Swagger / OpenAPI ​

  • Fangate-backend: run php artisan l5-swagger:generate so /api/documentation includes the new operations after deploy.
  • Fangate-docs: copy the generated api-docs.json into docs/public/openapi.json (or use npm run sync-openapi if your pipeline wires it), then rebuild the site so Swagger UI matches.

Notes ​

  • Live changelog: docs.fangate.app/changelog is produced from this file when the Fangate-docs site is built and deployed; merge and run your usual docs release so the new section appears there.
  • Backend code for these endpoints ships in Fangate-backend (not only documentation).

2026-05 price editing (creator links) ​

Documentation now covers explicit creator control over how a price change is applied: update the existing sellable link’s price, or create a new priced link while keeping the original unchanged.

Added / clarified ​

  • PATCH /api/products/{product}/price — update price on the existing product (same short link URL); validation matches product pricing rules (minor units, minimum).
  • POST /api/products/{product}/price-links — create a new product row with a new short link and new price; optional overrides for title and descriptions; 201 Created response documented.
  • API reference semantics — clarifies that checkout amounts are driven by products.price while public URLs live on short_links, and that the “new link” flow is implemented as a duplicate product with duplicated media rows pointing at the same storage paths (no re-upload).
  • Checkout and analytics behavior — documents server-side price revalidation at checkout start, pending sessions keeping a locked price, per-link metrics, and non-retroactive historical stats (per product agreement).
  • API keys — permission matrix extended for the two new paths alongside existing product write routes.

Notes ​

  • Backend implementation and OpenAPI annotations ship in Fangate-backend; regenerate Swagger (php artisan l5-swagger:generate) so /api/documentation lists these operations after deploy.

2026-04 backend documentation synchronization ​

This documentation pass aligns docs.fangate.app with the current live Fangate backend and recent backend changes deployed across development and production.

Added / clarified ​

  • full upload-session documentation for resumable, multipart, and remote-import upload flows
  • current product resource fields, including folder state, collection state, downloadability, and epoch-related flags
  • content-folder endpoints and creator-side folder assignment workflow
  • current wallet and affiliate endpoints, including invitation, invitation code, invited users, and affiliate revenue coverage
  • creator-tag / third-party consent flows, including verification-required responses for tagged users
  • current Veriff and Yoti endpoint behavior, including endpoints that do not use the standard API response wrapper
  • current report, feedback, maps autocomplete, and webhook behavior
  • current environment mapping for production and development API / Swagger endpoints

Backend behavior documented from recent changes ​

  • resumable upload-session backend flow is now the preferred content-ingestion path
  • legacy direct upload behavior remains supported and can return async 202 responses
  • content folder support is live in the backend via:
    • GET /api/content-folders
    • POST /api/content-folders
    • PATCH /api/content-folders/{contentFolder}
    • DELETE /api/content-folders/{contentFolder}
    • PATCH /api/products/{product}/folder
  • product deletion now includes explicit cleanup of legacy consent relations
  • private/final storage behavior and legacy-upload mirroring are documented to explain current sales-link media availability handling
  • production deploy workflow hardening and main-branch checkout expectations are part of the documented release/deployment history

Swagger / OpenAPI alignment work ​

  • API metadata updated for production and development servers
  • missing or incomplete docs added for affiliate revenue, consent-tag endpoints, maps autocomplete, report, and Veriff decision flows
  • resource schemas updated to better match current backend fields

Earlier documented backend release areas ​

2026-04-15 release / production rollout areas ​

Confirmed backend areas represented in documentation:

  • upload-session backend for resumable/direct-to-storage uploads
  • content folders and product-folder assignment
  • media URL/storage resolution fixes across process/final disks
  • related web media access and notification changes
  • Swagger/OpenAPI coverage improvements for new backend flows

2026-04-04 documentation and platform updates ​

Previously documented and retained as relevant:

  • post-purchase viewer and buyer-access improvements
  • creator consent tagging improvements
  • manual-approval notification updates

Notes ​

  • This changelog only lists changes that were confirmed from backend code, routes, resources, annotations, and recent git history.
  • Where an exact deployment label was unclear, the change is grouped by backend area rather than an invented release number.

Fangate backend developer documentation

© 2026 KYW Licensing Holding Limited