# Sports Card Portal API

Base URL: `https://sportscardportal.com/api/v2`

The API provides public read endpoints for news, card releases, card shows, card shops, auction houses, marketplace listings, community posts, checklists, glossary terms, and randomizer result lookup. Member actions such as creating listings, running randomizers, account changes, messaging, favorites, uploads, and private history require an approved verified account and a bearer token.

## Discovery

- API catalog: `https://sportscardportal.com/.well-known/api-catalog`
- OpenAPI: `https://sportscardportal.com/openapi.json`
- API health: `https://sportscardportal.com/api/v2/health`
- OAuth authorization metadata: `https://sportscardportal.com/.well-known/oauth-authorization-server`
- OAuth protected resource metadata: `https://sportscardportal.com/.well-known/oauth-protected-resource`
- Agent access instructions: `https://sportscardportal.com/auth.md`

## Authentication

Use `POST /auth/login` with a verified Sports Card Portal account. The response returns an opaque bearer token. Send it as:

```http
Authorization: Bearer <token>
```

Protected API responses use `401 Unauthorized` with a `WWW-Authenticate` header pointing agents to the protected resource metadata. Accounts with unverified email or enabled 2FA must complete those human account steps before API token use.

## Public Endpoints

- `GET /`
- `GET /health`
- `GET /app/config`
- `GET /app/menu`
- `GET /news`
- `GET /news/categories`
- `GET /news/{idOrSlug}`
- `GET /search`
- `GET /pages/{slug}`
- `GET /release-calendar`
- `GET /recent-releases`
- `GET /releases/{idOrSlug}`
- `GET /product/{idOrSlug}`
- `GET /card-shows`
- `GET /card-shows/{idOrSlug}`
- `GET /card-shops`
- `GET /card-shops/{idOrSlug}`
- `GET /auction-houses`
- `GET /community`
- `GET /community/posts/{idOrSlug}`
- `GET /checklists`
- `GET /checklists/{sportSlug}`
- `GET /checklists/{sportSlug}/{setSlug}`
- `GET /glossary`
- `GET /glossary/{slug}`
- `GET /marketplace`
- `GET /marketplace/{idOrSlug}`
- `GET /randomizer`
- `GET /randomizer/results/{uniqueId}`
- `GET /randomizer/{tool}`

## Protected Endpoints

- `POST /marketplace`
- `PATCH /marketplace/{idOrSlug}`
- `DELETE /marketplace/{idOrSlug}`
- `POST /marketplace/{idOrSlug}/images`
- `DELETE /marketplace/{idOrSlug}/images/{imageId}`
- `POST /marketplace/{idOrSlug}/favorite`
- `DELETE /marketplace/{idOrSlug}/favorite`
- `POST /marketplace/{idOrSlug}/contact`
- `POST /randomizer/{tool}`
- `GET /randomizer/history`
- `POST /auth/logout`
- `GET /auth/me`
- `GET /account/profile`
- `PATCH /account/profile`
- `GET /me`
- `GET /devices`

Do not use private admin routes, upload paths, message threads, account pages, or action endpoints unless they are documented in the OpenAPI file and authorized for the specific user.