Build an admin app on the Bagisto Admin API

/api/admin/*

POST /api/admin/graphql

⚠️ Load these FIRST (before any code)

1. reference/connecting-to-the-api.md

   — admin auth (the Integration Bearer token), the

   {data,meta}

   listing envelope, the list→detail→action pattern, permissions, errors, and the verify-before-coding protocol.

2. reference/graphql.md

   — if the client picked GraphQL: the admin endpoint, the result-field/

   id

   rule, camelCase inputs + filter args, cursor pagination.

https://api-docs.bagisto.com

/llms.txt

Step 1 — ask the client (CRITICAL, before building)

1. Platform — web, mobile (native/cross-platform), desktop?
2. Framework/stack — React/Next, Vue/Nuxt, Flutter, React Native, plain JS?
3. Which admin menus — Sales, Catalog, Customers, Marketing, CMS, Settings, Configuration, Dashboard/Reporting — or one first?
4. Transport — REST or GraphQL? (REST for list/detail/action screens; GraphQL when a screen needs many related fields in one round-trip. Both fully supported.)
5. First screen/flow — order list + actions, product management, Create-Order, a dashboard, …?

The core admin pattern: list → detail → action

connecting-to-the-api.md

• List —

  GET /api/admin/<resource>

  →

  { data, meta }

  envelope; drive tables with

  ?page=

  +

  ?per_page=

  + the screen's filters.
• Detail —

  GET /api/admin/<resource>/{id}

  → full record, relations embedded (no follow-up calls).
• Action —

  POST/PUT/DELETE

  for create/update/delete + per-record actions (cancel order, create invoice, mass-update, …), each with its own eligibility rules.

Step 2 — open the reference for the menu

Flagship flow

reference/flows/create-order.md

Menus (mirror the admin sidebar)

reference/menus/sales.md

reference/menus/catalog.md

reference/menus/customers.md

reference/menus/marketing.md

reference/menus/cms.md

reference/menus/settings.md

reference/menus/configuration.md

reference/menus/dashboard-reporting.md

Discovery — don't hardcode the nav or permissions

• GET /api/admin/menu

  (

  getAdminMenu

  ) — the admin sidebar as a permission-filtered tree; each node maps to its API endpoint (

  apiResource: { rest, graphql }

  , or

  null

  for group headers / panel-only screens).

• GET /api/admin/permissions

  (

  getAdminPermissions

  ) — the token's effective

  { permissionType, permissions }

  (

  ["*"]

  = full access).

reference/connecting-to-the-api.md

Consolidated critical rules

• Verify before coding. PAUSE → open the endpoint's docs page (or query the MCP) → confirm method/fields → implement → check types.
• Auth: every call sends

  Authorization: Bearer <id>|<token>

  (a pre-issued admin Integration token). There's no login endpoint — the token is made in the store's admin panel. The admin GraphQL endpoint is

  POST /api/admin/graphql

  (admin token only; not the shop endpoint, no storefront key).
• Permissions: a token is capped by its admin's role — an endpoint the role can't reach returns 403. Build for that.
• Listings are

  { data, meta }

  (+

  X-Total-*

  headers); page with

  ?page=

  /

  ?per_page=

  (default 10, cap 50) + the per-screen filters.
• GraphQL action mutations (cancel/invoice/shipment/refund/place-order/cart writes/mass-actions) return result fields, not a generic

  id

  ; inputs are camelCase; custom filter args are documented per page. See

  reference/graphql.md

  .
• Don't hardcode dynamic data (shipping/payment methods in Create-Order, config options) — fetch it.