StableX API

Mobile application API with WhatsApp authentication, point reward system, email verification, social media rewards, and referral mechanisms. Designed for user engagement and gamification.

WhatsApp Login

POST/api/xusers/login

Login with WhatsApp

Login or register user account via WhatsApp phone number. Creates new account if phone doesn't exist, awards 50 welcome points for new users. Generates JWT token for subsequent authenticated requests.

Parameters

phonestringrequired

WhatsApp phone number for authentication

Request Body

{
  "phone": "+628123456789"
}

Response

200Login successful

{
  "message": "Login successful",
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "user": {
    "userx_id": 123,
    "phonex": "+628123456789",
    "usernamex": null,
    "emailx": null,
    "point_balance": 50,
    "role": "user"
  }
}

400Missing phone number

{
  "error": "Phone number is required."
}

403Account deactivated

{
  "error": "Account is deactivated or deleted. Please contact support."
}

500Login failed

{
  "error": "Login failed",
  "details": "Database connection error"
}

curl -X POST https://api.brdz.link/api/xusers/login \
-H "Content-Type: application/json" \
-H "x-api-key: YOUR_API_KEY" \
-d '{
  "phone": "+628123456789"
}'

Get Notifications

GET/api/xusers/notifications

Get Push Notifications

Retrieve list of push notifications for authenticated user from x_push_logs table. Returns notifications ordered by creation date (newest first) with read status.

Response

200Notifications retrieved successfully

{
  "success": true,
  "notifications": [
    {
      "push_id": 456,
      "title": "Welcome to StableX!",
      "message": "Thank you for joining! You received 50 points as a welcome bonus.",
      "read": false,
      "created_at": "2024-01-15T10:30:00Z"
    },
    {
      "push_id": 457,
      "title": "Username Claimed!",
      "message": "Congratulations! Your username has been set, and you received 50 points.",
      "read": true,
      "created_at": "2024-01-14T15:20:00Z"
    }
  ]
}

401Unauthorized

{
  "error": "Unauthorized: User ID not found."
}

500Failed to fetch notifications

{
  "success": false,
  "error": "Failed to fetch notifications."
}

curl -X GET https://api.brdz.link/api/xusers/notifications \
-H "Authorization: Bearer YOUR_JWT_TOKEN" \
-H "x-api-key: YOUR_API_KEY"

Request Email Verification

POST/api/xmail/verify-email

Request Email Verification

Send 6-digit OTP code to email for verification. Checks email availability, prevents duplicate verification. OTP expires in 10 minutes. Updates user email and generates verification token.

Parameters

emailstringrequired

Email address to verify

Request Body

{
  "email": "user@example.com"
}

Response

200Verification code sent

{
  "success": true,
  "message": "Verification code sent to email."
}

400Email already verified or missing

{
  "error": "Email is already verified."
}

401Unauthorized

{
  "error": "Unauthorized: User ID not found."
}

409Email already in use

{
  "error": "Email is already in use by another verified user."
}

500Email verification failed

{
  "success": false,
  "error": "Failed to initiate email verification."
}

curl -X POST https://api.brdz.link/api/xmail/verify-email \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_JWT_TOKEN" \
-H "x-api-key: YOUR_API_KEY" \
-d '{
  "email": "user@example.com"
}'

Confirm Email Verification

POST/api/xmail/confirm-email

Confirm Email Verification

Verify email using 6-digit OTP code. Awards 50 points for first-time email verification. Marks email as verified and clears verification tokens. Sends push notification on success.

Parameters

otp_codestringrequired

6-digit OTP code received via email

Request Body

{
  "otp_code": "123456"
}

Response

200Email verified successfully

{
  "success": true,
  "message": "Email verified successfully.",
  "points_awarded": 50,
  "already_rewarded": false
}

400Invalid or expired code

{
  "error": "Invalid verification code."
}

404User not found

{
  "error": "User not found."
}

500Verification failed

{
  "success": false,
  "error": "Email verification failed."
}

400_expiredOTP expired

{
  "error": "Verification code expired."
}

curl -X POST https://api.brdz.link/api/xmail/confirm-email \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_JWT_TOKEN" \
-H "x-api-key: YOUR_API_KEY" \
-d '{
  "otp_code": "123456"
}'

Claim Username

POST/api/xprofiles/claim-username

Claim Username

Set unique username for user account. Awards 50 points for first-time username claim. Checks username availability and prevents duplicate claims. Sends push notification on success.

Parameters

usernamestringrequired

Desired username (must be unique)

Request Body

{
  "username": "john_doe"
}

Response

200Username claimed successfully

{
  "message": "Username claimed successfully.",
  "points_awarded": 50,
  "already_rewarded": false
}

400Username required

{
  "error": "Username is required."
}

404User not found

{
  "error": "User not found."
}

409Username taken

{
  "error": "Username is already taken."
}

500Username claim failed

{
  "error": "Failed to claim username",
  "details": "Database update failed"
}

curl -X POST https://api.brdz.link/api/xprofiles/claim-username \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_JWT_TOKEN" \
-H "x-api-key: YOUR_API_KEY" \
-d '{
  "username": "john_doe"
}'

Get User Profile

GET/api/xprofiles/getme

Get User Profile

Retrieve complete user profile including point balance and reward completion status. Shows username claim, email verification, contact sync, and social media reward status from multiple tables.

Response

200Profile retrieved successfully

{
  "success": true,
  "profile": {
    "usernamex": "john_doe",
    "emailx": "john@example.com",
    "phonex": "+628123456789",
    "point_balance": 250,
    "userx_id": 123,
    "claim_username": true,
    "verify_email": true,
    "sync_contact": true,
    "social_facebook": false,
    "social_instagram": true,
    "social_x": false,
    "social_discord": false
  }
}

401Unauthorized

{
  "error": "Unauthorized. No user ID found in token."
}

404User not found

{
  "error": "User not found."
}

500Failed to get profile

{
  "error": "Failed to get profile"
}

curl -X GET https://api.brdz.link/api/xprofiles/getme \
-H "Authorization: Bearer YOUR_JWT_TOKEN" \
-H "x-api-key: YOUR_API_KEY"

Sync Contacts

POST/api/xcontacts/sync

Sync Contacts

Import user contacts and award 50 points for first-time sync. Performs bulk insert of contacts to x_contacts table. Replaces existing contacts and sends push notification for new syncs.

Parameters

contactsarrayrequired

Array of contact objects with name and phone

Request Body

{
  "contacts": [
    {
      "contact_name": "Alice Johnson",
      "contact_phone": "+628111111111"
    },
    {
      "contact_name": "Bob Smith",
      "contact_phone": "+628222222222"
    }
  ]
}

Response

200Contacts synced successfully

{
  "message": "Contacts synced successfully.",
  "points_awarded": 50,
  "already_rewarded": false
}

400Contacts array required

{
  "error": "Contacts array is required."
}

500Sync failed

{
  "error": "Failed to sync contacts."
}

curl -X POST https://api.brdz.link/api/xcontacts/sync \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_JWT_TOKEN" \
-H "x-api-key: YOUR_API_KEY" \
-d '{
  "contacts": [
    {
      "contact_name": "Alice Johnson",
      "contact_phone": "+628111111111"
    },
    {
      "contact_name": "Bob Smith",
      "contact_phone": "+628222222222"
    }
  ]
}'

Add Inviter

POST/api/xreff/add-inviter

Add Inviter

Link user to their inviter (referrer) using phone number. Awards 50 points for successful referral link. Prevents self-invitation and duplicate inviter assignments. Creates entry in x_referrals table.

Parameters

inviter_phonestringrequired

WhatsApp phone number of the person who invited this user

Request Body

{
  "inviter_phone": "+628987654321"
}

Response

200Inviter linked successfully

{
  "message": "Inviter linked and reward granted.",
  "points_awarded": 50
}

400Cannot invite yourself

{
  "error": "You cannot invite yourself."
}

404Inviter not found

{
  "error": "Inviter not found."
}

500Failed to add inviter

{
  "error": "Failed to add inviter."
}

200_already_existsUser already has inviter

{
  "message": "You already have an inviter."
}

curl -X POST https://api.brdz.link/api/xreff/add-inviter \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_JWT_TOKEN" \
-H "x-api-key: YOUR_API_KEY" \
-d '{
  "inviter_phone": "+628987654321"
}'

Get Invited Friends

GET/api/xreff/invited-friends

Get Invited Friends

Retrieve list of friends invited by current user. Shows user details and invitation timestamp from x_referrals JOIN x_users tables. Ordered by most recent invitations first.

Response

200Invited friends retrieved

{
  "success": true,
  "invited": [
    {
      "userx_id": 124,
      "usernamex": "alice_doe",
      "emailx": "alice@example.com",
      "phonex": "+628111111111",
      "created_at": "2024-01-15T10:30:00Z"
    },
    {
      "userx_id": 125,
      "usernamex": null,
      "emailx": null,
      "phonex": "+628222222222",
      "created_at": "2024-01-14T15:20:00Z"
    }
  ]
}

500Failed to fetch invited friends

{
  "error": "Failed to fetch invited friends."
}

curl -X GET https://api.brdz.link/api/xreff/invited-friends \
-H "Authorization: Bearer YOUR_JWT_TOKEN" \
-H "x-api-key: YOUR_API_KEY"

Claim Social Media Reward

POST/api/xsocial/claim

Claim Social Media Reward

Claim 50-point reward for following StableX on social media platforms. Supports platform mapping from URLs to standard names. Prevents duplicate claims per platform. Creates entry in x_social_rewards table.

Parameters

platformstringrequired

Social media platform or URL (facebook, instagram, x, discord, or full URLs)

Request Body

{
  "platform": "https://www.instagram.com/stablex.money/"
}

Response

200Reward claimed successfully

{
  "message": "Reward for instagram claimed.",
  "points_awarded": 50
}

400Invalid platform

{
  "error": "Invalid or unrecognized platform provided."
}

401Unauthorized

{
  "error": "Unauthorized: User ID not found."
}

500Failed to claim reward

{
  "error": "Failed to claim social reward"
}

200_already_claimedAlready claimed for platform

{
  "message": "Already claimed reward for instagram.",
  "points_awarded": 0,
  "already_rewarded": true
}

curl -X POST https://api.brdz.link/api/xsocial/claim \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_JWT_TOKEN" \
-H "x-api-key: YOUR_API_KEY" \
-d '{
  "platform": "https://www.instagram.com/stablex.money/"
}'

Soft Delete Account

DELETE/api/xaccount/delete

Soft Delete Account

Mark user account as deleted without permanent removal. Sets is_deleted flag to true in x_users_raw table. Account can potentially be restored by admin. Prevents future login attempts.

Response

200Account deleted successfully

{
  "message": "Account successfully deleted."
}

401Unauthorized

{
  "error": "Unauthorized. No user ID found in token."
}

500Deletion failed

{
  "error": "Failed to delete account"
}

curl -X DELETE https://api.brdz.link/api/xaccount/delete \
-H "Authorization: Bearer YOUR_JWT_TOKEN" \
-H "x-api-key: YOUR_API_KEY"

Request OTP

POST/api/xotp/request

Request OTP Verification

Send OTP code via WhatsApp or SMS for verification purposes. Supports multiple purposes and delivery channels. Uses Twilio service for message delivery with callback tracking.

Parameters

phone_numberstringrequired

Phone number to send OTP to

purposestringrequired

Purpose of OTP (e.g., 'login', 'verification', 'password_reset')

channelstring

Delivery channel (default: 'wa' for WhatsApp, also supports 'sms')

Request Body

{
  "phone_number": "+628123456789",
  "purpose": "login",
  "channel": "wa"
}

Response

200OTP sent successfully

{
  "success": true,
  "message": "OTP sent successfully",
  "otp_id": "otp_12345",
  "expires_at": "2024-01-15T10:40:00Z"
}

400Missing required fields

{
  "error": "phone_number and purpose are required."
}

500OTP request failed

{
  "error": "Failed to request OTP",
  "details": "Twilio service unavailable"
}

curl -X POST https://api.brdz.link/api/xotp/request \
-H "Content-Type: application/json" \
-H "x-api-key: YOUR_API_KEY" \
-d '{
  "phone_number": "+628123456789",
  "purpose": "login",
  "channel": "wa"
}'

Verify OTP

POST/api/xotp/verify

Verify OTP Code

Verify OTP code against purpose and phone number. Validates code expiration and correctness. Marks OTP as used after successful verification to prevent replay attacks.

Parameters

phone_numberstringrequired

Phone number that received the OTP

purposestringrequired

Purpose that matches the OTP request

otp_codestringrequired

OTP code received via WhatsApp/SMS

Request Body

{
  "phone_number": "+628123456789",
  "purpose": "login",
  "otp_code": "123456"
}

Response

200OTP verified successfully

{
  "success": true,
  "message": "OTP verified successfully",
  "verified_at": "2024-01-15T10:35:00Z"
}

400Invalid or expired OTP

{
  "error": "Invalid or expired OTP code."
}

500Verification failed

{
  "error": "Failed to verify OTP",
  "details": "Database query failed"
}

curl -X POST https://api.brdz.link/api/xotp/verify \
-H "Content-Type: application/json" \
-H "x-api-key: YOUR_API_KEY" \
-d '{
  "phone_number": "+628123456789",
  "purpose": "login",
  "otp_code": "123456"
}'

Get Wishlist Count

GET/api/xwishlist/count

Get Wishlist Count

Retrieve current dynamic wishlist counter. Combines base count (1010), actual user count, and random increments. Updates every hour with random increments (3-10) for engagement purposes.

Response

200Wishlist count retrieved

{
  "success": true,
  "count": 1247
}

500Failed to get count

{
  "success": false,
  "error": "Failed to get wishlist count."
}

curl -X GET https://api.brdz.link/api/xwishlist/count \
-H "x-api-key: YOUR_API_KEY"

Point Reward System

Reward Structure

Action	Points	Requirements	Notes
Welcome Login	50	First-time registration	Automatic on new account
Claim Username	50	Unique username	One-time reward
Verify Email	50	Valid email + OTP	One-time reward
Sync Contacts	50	Contact import	One-time reward
Add Inviter	50	Valid referrer phone	One-time reward
Social Media	50 each	Follow on platforms	Per platform once

Supported Social Platforms

Backend maps URLs to standard platform names:

• Facebook: https://facebook.com/ → facebook
• Instagram: https://www.instagram.com/stablex.money/ → instagram
• X (Twitter): https://x.com/BrdzStablecoin → x
• Discord: https://discord.gg/uGzV3nfD → discord

Authentication Flow

Complete Registration & Reward Flow

// 1. WhatsApp Login (50 points for new users)
const login = await loginWithWhatsApp({ phone: '+628123456789' });

// 2. Claim Username (50 points)
await claimUsername({ username: 'john_doe' });

// 3. Verify Email (50 points)
await requestEmailVerification({ email: 'john@example.com' });
await confirmEmailVerification({ otp_code: '123456' });

// 4. Sync Contacts (50 points)
await syncContacts({ 
  contacts: [
    { contact_name: 'Alice', contact_phone: '+628111111111' }
  ]
});

// 5. Add Inviter (50 points)
await addInviter({ inviter_phone: '+628987654321' });

// 6. Social Media Rewards (50 points each)
await claimSocialReward({ platform: 'instagram' });
await claimSocialReward({ platform: 'facebook' });

// Total possible: 350+ points

Database Tables

Based on controller implementation:

• x_users_raw/x_users: Main user data with view aggregation
• x_points: Point transaction history with source tracking
• x_push_logs: Push notification storage
• x_contacts: User contact imports
• x_referrals: Referral relationship mapping
• x_social_rewards: Social media platform reward tracking
• x_meta: System metadata (wishlist counters, etc.)

Security Features

• JWT Authentication: Required for most endpoints
• One-time Rewards: Prevents duplicate point farming
• Soft Delete: Account deactivation without data loss
• OTP Verification: WhatsApp/SMS based verification
• Anti-fraud: Self-invitation prevention, duplicate checks

---

Authentication Required

Most endpoints require JWT token from WhatsApp login. Only login, OTP operations, and wishlist count are public endpoints.

Point Rewards

All point rewards are one-time only. System tracks completion status to prevent farming. Points are automatically credited with push notifications.

Social Media Integration

Platform URLs are automatically mapped to standard names. Users can provide either full URLs or platform names for social media rewards.