Mobile API overview

Formspring mobile apps authenticate with Sanctum personal access tokens scoped for native clients and call a thin BFF layer on top of the existing /api/v1 surface.

Auth

• POST /api/v1/mobile/auth/login — email + password, returns token + workspaces (2FA supported)
• POST /api/v1/mobile/auth/logout — revoke the current device token
• Passkeys and SSO reuse existing web ceremonies; the finish step returns a mobile token

Send Authorization: Bearer <token>, X-Workspace-Id, and X-Client: mobile/<platform>/<version> on every request.

* * *

BFF highlights

Endpoint	Purpose
GET /api/v1/mobile/home	Home digest (bookings, counts, attention items)
GET /api/v1/mobile/submissions	Unified inbox across forms, surveys, funnels
GET /api/v1/mobile/appointments	Booking list + confirm / decline / cancel
GET /api/v1/mobile/search	Permission-filtered fan-out search

Mutations proxy to the per-product REST endpoints; the BFF adds cursor pagination, normalized shapes, and Idempotency-Key deduplication for offline replay.

* * *

Related

• REST API overview
• Authentication
• Tokens & abilities