# API Documentation

## Overview

This document describes the RESTful APIs available in the Smart Lab LIMS system.

**Base URL:** `https://your-domain.com/api/`

**Authentication:** Most endpoints require authentication via session or API key.

---

## Authentication

### Login
**Endpoint:** `POST /index.php` (with login credentials)

**Request:**
```json
{
  "username": "admin",
  "password": "password123"
}
```

**Response:**
```json
{
  "success": true,
  "message": "تم تسجيل الدخول بنجاح"
}
```

---

## Clinic Results API

### Get Results by Order Number
**Endpoint:** `GET /api/clinic_results.php`

**Parameters:**
- `api_key` (required): API key for authentication
- `order_number` (required): Order number (e.g., "O12345")

**Example:**
```
GET /api/clinic_results.php?api_key=YOUR_API_KEY&order_number=O12345
```

**Response:**
```json
{
  "success": true,
  "data": {
    "order_number": "O12345",
    "patient_name": "أحمد محمد",
    "order_date": "2024-01-15",
    "results": [
      {
        "test_name": "CBC",
        "result_value": "5.2",
        "unit": "x10^9/L",
        "reference_range": "4.0-11.0",
        "flag": "normal"
      }
    ]
  }
}
```

### Get Results by Patient ID
**Endpoint:** `POST /api/clinic_results.php`

**Request Body:**
```json
{
  "api_key": "YOUR_API_KEY",
  "patient_id": 123
}
```

---

## Doctor Notifications API

### Get Notifications
**Endpoint:** `GET /api/doctor_notifications.php`

**Authentication:** Requires doctor session

**Response:**
```json
{
  "success": true,
  "data": {
    "notifications": [
      {
        "id": 1,
        "type": "critical_result",
        "message": "نتيجة حرجة للمريض أحمد",
        "created_at": "2024-01-15 10:30:00"
      }
    ],
    "unread_count": 5
  }
}
```

---

## Global Search API

### Search
**Endpoint:** `GET /api/global_search.php`

**Parameters:**
- `q` (required): Search query

**Example:**
```
GET /api/global_search.php?q=أحمد
```

**Response:**
```json
{
  "success": true,
  "data": {
    "patients": [
      {
        "id": 123,
        "patient_code": "P001",
        "full_name": "أحمد محمد",
        "phone": "07501234567"
      }
    ],
    "orders": [
      {
        "id": 456,
        "order_number": "O12345",
        "patient_name": "أحمد محمد"
      }
    ],
    "doctors": []
  }
}
```

---

## Offline Sync API

### Sync Data
**Endpoint:** `POST /api/offline_sync.php`

**Authentication:** Requires session

**Request Body:**
```json
{
  "action": "sync",
  "data": {
    "patients": [...],
    "orders": [...],
    "results": [...]
  }
}
```

**Response:**
```json
{
  "success": true,
  "data": {
    "synced": 10,
    "errors": []
  }
}
```

---

## Error Responses

All endpoints return errors in the following format:

```json
{
  "success": false,
  "error": "Error message",
  "code": "ERROR_CODE"
}
```

**HTTP Status Codes:**
- `200` - Success
- `400` - Bad Request
- `401` - Unauthorized
- `403` - Forbidden
- `404` - Not Found
- `429` - Too Many Requests (Rate Limited)
- `500` - Internal Server Error

---

## Rate Limiting

API endpoints are rate-limited to prevent abuse:
- **Default:** 100 requests per hour per IP
- **Login:** 5 attempts per 15 minutes
- **Search:** 30 requests per minute

When rate limited, the API returns:
```json
{
  "success": false,
  "error": "Too many requests. Please try again later.",
  "code": "RATE_LIMIT_EXCEEDED",
  "retry_after": 3600
}
```

---

## Security Headers

All API responses include security headers:
- `X-Frame-Options: DENY`
- `X-Content-Type-Options: nosniff`
- `X-XSS-Protection: 1; mode=block`
- `Content-Security-Policy: ...`

---

## Versioning

Current API Version: **1.0**

API versioning will be implemented in future updates.

---

## Support

For API support, please contact the system administrator.
