Onboarding API

Base route: /api/onboarding
Auth required: ❌ All endpoints are public (no [Authorize])

The onboarding module handles the one-time first-run setup before any users exist.
The frontend calls GET /api/onboarding/status on startup and redirects to /onboarding when not yet set up.

---

GET /api/onboarding/status

Returns whether the initial setup has been completed.

The setup is considered complete when:

1. An OwnPharmacy vendor exists
2. At least one user account exists

Response 200 OK

{
  "isOnboarded": false
}

Field	Description
isOnboarded	true if setup is complete — frontend should redirect to login

---

POST /api/onboarding/setup

Creates the pharmacy vendor and the first admin user in a single operation.

WARNING

This endpoint is only intended to be called once, during first-run setup.
Calling it again after onboarding is complete returns 400 Bad Request.

Request Body

{
  "pharmacy": {
    "name": "City Pharmacy",
    "address": "1 Main Street, Mumbai",
    "phone": "+91 98000 00000",
    "email": "admin@citypharmacy.com",
    "drugLicenseNumber1": "MH-11111"
  },
  "adminUser": {
    "firstName": "Admin",
    "lastName": "User",
    "email": "admin@citypharmacy.com",
    "password": "SecurePass123!"
  }
}

Pharmacy Fields

Field	Required	Description
name	✅	Pharmacy display name
address	—	Physical address
phone	—	Contact number
email	—	Contact email
drugLicenseNumber1	—	Primary drug license

Admin User Fields

Field	Required	Description
firstName	✅
lastName	✅
email	✅	Must be unique
password	✅	Min 8 characters

Response 200 OK

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expiresAt": "2026-03-18T10:00:00Z",
  "user": {
    "id": 1,
    "firstName": "Admin",
    "lastName": "User",
    "email": "admin@citypharmacy.com",
    "roleId": 1
  }
}

The response includes a JWT token so the admin user is immediately logged in after setup.

Response 400 Bad Request — Setup already completed