Home / Framework / API reference

DojoCover API reference

The REST API behind every DojoCover screen. Use it for API tests, and to set up data and sessions for UI tests.

The basics

  • Base URL: https://testdojo.dev/api/cover
  • Sign in: POST /login returns a token. Send it as Authorization: Bearer <token>. The same call sets the dc_session cookie, which you can give to the browser to skip the login screen.
  • Bodies are JSON, with Content-Type: application/json. Errors are { "error": "..." }, plus fields for validation errors.
  • Amounts are whole numbers in the account's currency, set when it was registered. GET /me tells you which, and the adjuster's approval limit.
  • Your data only: every request sees only the signed-in account's data.
  • OpenAPI: import openapi.json into Postman, Insomnia or a code generator.

Accounts

POST /register

Create a practice account. Who: Anyone.

Made-up details only. Returns the generated account ID and one login per role. Limited to 10 per network address per hour.

Example body

{
  "fullName": "Asha Verma",
  "dateOfBirth": "1995-04-21",
  "gender": "Female",
  "phone": "+91 98765 43210",
  "address": "12 Lake View Road",
  "city": "Bengaluru",
  "state": "Karnataka",
  "postalCode": "560001",
  "country": "India",
  "password": "Choose#Your1",
  "confirmPassword": "Choose#Your1",
  "acceptTerms": true,
  "currency": "INR"
}

Responses

  • 201 Created: { accountId, currency, logins: [{ username, role }] }
  • 422 Validation failed: fields says which
  • 429 Too many registrations: wait Retry-After seconds

POST /login

Sign in. Who: Anyone.

Returns a token for the Authorization: Bearer header, and also sets the dc_session cookie for the browser. shortSession: true makes the session last 2 minutes.

Example body

{
  "username": "QA-7K2M9-customer",
  "password": "Choose#Your1",
  "shortSession": false
}

Responses

  • 200 { token, expiresAt, user: { username, role, name, accountId } }
  • 400 User ID or password missing
  • 401 Wrong user ID or password, with attempts left
  • 403 This login is disabled
  • 423 Locked out after 5 wrong passwords: try again later

POST /logout

Sign out. Who: Anyone.

Clears the cookie.

Responses

  • 204 Signed out

GET /me

The signed-in user. Who: Any role.

Includes the account currency and the adjuster approval limit.

Responses

  • 200 { user, account: { currency, adjusterLimit }, profile, session: { expiresAt } }
  • 401 Not signed in, or the session expired

POST /reset

Reset the account data. Who: Any role.

Puts every policy, claim and login back to the starting sample data. Useful before a test run.

Responses

  • 200 { reset: true }

POST /account/delete

Delete the account. Who: Any role.

Deletes the account, every role login and all data.

Example body

{
  "password": "Choose#Your1"
}

Responses

  • 204 Deleted
  • 401 Wrong password

Policies

GET /policies

List policies. Who: Any role.

Customers and adjusters see the policies they hold; managers and admins see all.

Query parameters

  • q: Search text
  • type: Motor, Home, Health or Travel
  • status: Active, Expired or Cancelled
  • sort: One of: id, title, type, coverage, endDate
  • dir: asc or desc
  • page: Page number, from 1
  • pageSize: 1 to 50 (default 10)

Responses

  • 200 A page of policies

GET /policies/{id}

One policy. Who: Any role.

Responses

  • 200 The policy
  • 404 Not found, or not yours to see

POST /policies

Create a policy. Who: Admin.

Example body

{
  "holder": "customer",
  "type": "Travel",
  "title": "Asia trip",
  "coverage": 8000,
  "startDate": "2026-01-01",
  "endDate": "2027-01-01"
}

Responses

  • 201 The new policy, numbered POL-2009 and up
  • 403 Not an admin
  • 422 Validation failed

POST /policies/{id}/cancel

Cancel a policy. Who: Admin.

Responses

  • 200 The cancelled policy
  • 409 Only an active policy can be cancelled

Claims

GET /claims

List claims. Who: Customer, adjuster, manager, admin.

Customers see the claims they filed; staff see every claim.

Query parameters

  • q: Search text
  • status: Submitted, Info requested, Manager review, Approved, Rejected or Withdrawn
  • sort: One of: id, amount, status, createdAt, updatedAt
  • dir: asc or desc
  • page: Page number, from 1
  • pageSize: 1 to 50 (default 10)

Responses

  • 200 A page of claims

GET /claims/{id}

One claim, with history and allowed actions. Who: Any role who can see it.

actions lists what the signed-in role may do now. version is needed to change the claim.

Responses

  • 200 The claim
  • 404 Not found, or not yours to see

POST /claims

File a claim. Who: Customer, adjuster (on their own policies).

The policy must be active, the date within the policy period and not in the future, and the amount within the coverage. details depends on the type: Motor needs vehicleReg and policeReport ("yes" adds reportNumber PR-12345); Home needs cause; Health needs hospital; Travel needs destination. Documents are 1 to 5 entries of name, type (application/pdf, image/jpeg, image/png) and size in bytes, under 5 MB.

Example body

{
  "policyId": "POL-2001",
  "incidentDate": "2026-11-01",
  "amount": 1200,
  "description": "Rear bumper damaged in a car park.",
  "details": {
    "vehicleReg": "KA01AB1234",
    "policeReport": "no"
  },
  "documents": [
    {
      "name": "photo.jpg",
      "type": "image/jpeg",
      "size": 204800
    }
  ]
}

Responses

  • 201 The new claim, status Submitted
  • 403 This role cannot file claims
  • 422 Validation failed: fields says which

POST /claims/{id}/actions

Act on a claim. Who: Depends on the action.

action is request-info (adjuster, needs note), approve (adjuster or manager, optional payout up to the amount), reject (adjuster or manager, needs note as the reason), respond (customer, needs note) or withdraw (customer). An adjuster approving a claim above their limit sends it to Manager review. Nobody can decide a claim they filed. version must match the claim's current version.

Example body

{
  "action": "approve",
  "version": 1,
  "payout": 1000,
  "note": "Approved after review"
}

Responses

  • 200 The updated claim
  • 400 version missing
  • 403 This role cannot do this, or it is their own claim
  • 409 Someone else changed the claim (version mismatch), or the action does not fit its status
  • 422 note or payout invalid

POST /claims/{id}/feedback

Rate a decided claim. Who: Customer.

Example body

{
  "rating": 4,
  "comment": "Quick payout"
}

Responses

  • 200 The claim, with a Feedback event
  • 409 Not decided yet, or already rated
  • 422 rating must be 1 to 5

Admin and reports

GET /admin/users

List the role logins. Who: Admin.

Responses

  • 200 { items: [{ username, role, roleName, name, status, failedAttempts }] }

PATCH /admin/users/{role}

Disable, enable or unlock a login. Who: Admin.

Example body

{
  "disabled": true,
  "clearLockout": false
}

Responses

  • 200 The updated user
  • 409 An admin cannot disable their own login

GET /reports/claims

Claims summary. Who: Manager, admin.

Query parameters

  • from: Filed on or after, YYYY-MM-DD
  • to: Filed on or before, YYYY-MM-DD

Responses

  • 200 { total, byStatus, byType, amountClaimed, amountPaid }
  • 422 Invalid dates

GET /reports/claims.csv

Claims as a CSV download. Who: Manager, admin.

Query parameters

  • from: As above
  • to: As above

Responses

  • 200 text/csv with Content-Disposition: attachment