# uwan.app

> uWAN is an enterprise BoreasTUN SDWAN monitoring, topology visibility, and secure remote VPN provisioning service.

## API Endpoints

### 1. Authentication & Accounts
- `POST /api/client/register` — Register a new VPN client with email, password, and first/last name.
- `POST /api/client/auth/login` — Authenticate an existing VPN client and receive a JWT.
- `POST /api/client/auth/google` — Sign in or register via Google OAuth. Request: `{ "idToken": "..." }`.
- `POST /api/client/auth/apple` — Sign in or register via Apple OAuth. Request: `{ "identityToken": "...", "firstName": "...", "lastName": "..." }`.

### 2. Client Profile & Configuration
- `GET /api/client/me` — Retrieve the client profile metadata and assigned servers.
- `GET /api/client/config/toml` — Download WireGuard/BoreasTUN TOML configuration files. Query parameters: `serverId` (optional), `format` (`"json"` or `"raw"`).

### 3. Server Management
- `GET /api/client/servers` — List available VPN servers with locations, geographic coordinates, protocol, and assignments.
- `POST /api/client/servers/connect` — Provision a WireGuard peer on the target server via SSH/CLI and connect client. Request: `{ "serverId": 6, "makePrimary": true }`.
- `DELETE /api/client/servers/connect` — Disconnect the client from a server and de-provision the WireGuard peer. Query: `?serverId=6`.

### 4. Account Security & Verification
- `POST /api/client/resend-verification` — Send a new 6-digit email verification code.
- `POST /api/client/verify-email` — Verify the email using a 6-digit code. Request: `{ "code": "123456" }`.
- `POST /api/client/forgot-password` — Initiate password recovery. Request: `{ "email": "..." }`.
- `POST /api/client/verify-reset-code` — Verify password reset code. Request: `{ "email": "...", "code": "..." }`.
- `POST /api/client/reset-password` — Set a new password. Request: `{ "email": "...", "code": "...", "newPassword": "..." }`.
- `GET /api/client/login-history` — Paginated history of client log-in attempts.

### 5. Daemon Metrics Query
- `GET /metrics` — Retrieve raw daemon metrics (throughput, active peers, handshake counts, latency, P2P states, FEC stats) in Prometheus text format.

## Authentication

Mobile client API endpoints require JWT authorization:
`Authorization: Bearer <jwt-token>`

Metrics queries require a daemon-level secret API key:
`Authorization: Bearer <metrics-api-key>`

## Examples

### 1. Retrieve Client Configuration (JSON)
```bash
curl -X GET "https://uwan.app/api/client/config/toml?serverId=5" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."
```

### 2. Connect to a VPN Server
```bash
curl -X POST "https://uwan.app/api/client/servers/connect" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \
  -H "Content-Type: application/json" \
  -d '{"serverId": 6, "makePrimary": true}'
```

### 3. Query Daemon Metrics
```bash
curl -X GET "https://uwan.app/metrics" \
  -H "Authorization: Bearer sk_boreas_IL1ITWWUJ5A2DwPdMS11YGiTqQPkHuBG"
```

## Documentation

- [API Reference](/docs/API.md) — Detailed specifications of all mobile REST APIs.
- [Metrics Guide](/docs/METRICS_API_REFERENCE.md) — Information about Prometheus metrics counters and gauges.
- [Database Guide](/docs/DUAL-DATABASE-SETUP.md) — How to configure TimescaleDB and Supabase.
- [Features Overview](/docs/FEATURES.md) — Capabilities of the BoreasTUN SDWAN.