Test the API¶

When the API runs outside production, open Swagger UI at http://localhost:8080/swagger-ui/index.html. The full-stack Compose port is 8082 instead.

With curl, first create a cookie jar and capture CSRF:

curl -c cookies.txt http://localhost:8080/v1/csrf

Read the XSRF-TOKEN value from cookies.txt, then use it in a write request:

curl -b cookies.txt \
  -H 'Content-Type: application/json' \
  -H 'X-XSRF-TOKEN: <cookie-value>' \
  -d '{"username":"alice","password":"correct-horse-battery-staple"}' \
  http://localhost:8080/v1/authenticate

Add -H 'Authorization: Bearer <jwt>' for protected endpoints. Use disposable local credentials and never paste production tokens into command history.