# FAQ, CMS Contents & Application Settings APIs

Currency remains **USD**. Change Password APIs are unchanged.

All admin endpoints require:

```http
Authorization: Bearer <accessToken>
```

Role: **admin** (`@ApiAuthPermission(true, 'admin')`).

Pagination uses project convention: `page` / `take` (max 100). Query alias `limit` is accepted and mapped to `take`.

Response envelope: `listingApiWrapper` / `listingApiWrapperPaginate`.

---

## FAQ

| Method | Path | Access | Purpose |
| ------ | ---- | ------ | ------- |
| GET | `/admin/faqs` | Admin | List (search, status, pagination) |
| POST | `/admin/faqs` | Admin | Create |
| GET | `/admin/faqs/:id` | Admin | Detail |
| PATCH | `/admin/faqs/:id` | Admin | Partial update |
| DELETE | `/admin/faqs/:id` | Admin | Soft-deactivate → INACTIVE |
| GET | `/faqs` | Public | ACTIVE FAQs only |
| GET | `/faq` | Public | Legacy alias of `/faqs` |

Delete does **not** hard-delete; sets `status=INACTIVE`.

---

## CMS Contents

| Method | Path | Access | Purpose |
| ------ | ---- | ------ | ------- |
| GET | `/admin/contents` | Admin | List (no full body) |
| POST | `/admin/contents` | Admin | Create (unique key) |
| GET | `/admin/contents/key/:key` | Admin | By key |
| GET | `/admin/contents/:id` | Admin | Detail |
| PATCH | `/admin/contents/:id` | Admin | Partial update |
| DELETE | `/admin/contents/:id` | Admin | Soft-deactivate |
| GET | `/contents/:key` | Public | ACTIVE only |

Seeded keys (idempotent, never overwrite): `about_us`, `privacy_policy`, `terms_conditions`, `return_refund_policy`, `cancellation_policy`, `driver_terms_conditions`, `contact_us`.

Placeholder legal HTML **must be reviewed/replaced** before production.

HTML is sanitized on write (scripts/event handlers/iframes stripped).

---

## Settings

| Method | Path | Access | Purpose |
| ------ | ---- | ------ | ------- |
| GET | `/admin/settings` | Admin | Get/create singleton |
| PATCH | `/admin/settings` | Admin | Partial update |
| GET | `/settings` | Public | Public fields only |

Field `face_book` is intentional (not renamed to `facebook`).

Public response never includes secrets, JWT, env, or DB config.