Endpoints, permissions and keys
Every ICO Launchpad route with its method and permission, the fifteen permission keys, the settings keys the backend reads, the status values, the database tables and the two cron jobs.
Everything on this page is what the addon actually exposes. Routes not listed do not exist.
Public routes
These carry no authentication requirement at all — anonymous visitors can read them. That is deliberate: the offer browser and the landing page are marketing surfaces.
| Method | Path | Returns |
|---|---|---|
GET |
/api/ico/landing |
Landing page payload: platform stats, featured offerings, upcoming projects, success stories |
GET |
/api/ico/stats |
Platform-wide ICO statistics |
GET |
/api/ico/offer |
Offerings filtered by status, with search, blockchain and token-type filters, pagination and sorting |
GET |
/api/ico/offer/[id] |
A single offering with its token detail, phases, team, roadmap and updates |
GET |
/api/ico/offer/featured |
Popular offerings |
GET |
/api/ico/offer/stats |
Counts by status |
GET |
/api/ico/blockchain |
Active blockchain configurations |
GET |
/api/ico/token/type |
Enabled token types |
GET |
/api/ico/plan |
Available launch plans |
GET /api/ico/offer accepts status=COMPLETED as a convenience, which returns
both SUCCESS and FAILED offerings.
Investor routes
Signed in, and subject to the purchase_ico KYC feature where it applies.
| Method | Path | Does |
|---|---|---|
POST |
/api/ico/transaction |
Buys tokens. Takes offeringId, amount, walletAddress |
GET |
/api/ico/transaction |
The caller's contribution history |
GET |
/api/ico/transaction/[id] |
One contribution |
GET |
/api/ico/portfolio |
Portfolio overview |
GET |
/api/ico/portfolio/investments |
Investment list |
GET |
/api/ico/portfolio/performance |
Portfolio performance series |
GET |
/api/ico/vesting |
The caller's vesting schedules, optionally for one offering |
GET |
/api/ico/refund/eligibility/[offeringId] |
Whether an offering is refundable, and the counts behind it |
POST |
/api/ico/refund/process |
Refunds every outstanding contribution on a FAILED or CANCELLED offering |
The last two gate on relationship rather than permission. Eligibility is readable by the offering's creator, any administrator, or anybody holding a contribution in it. The refund run accepts the creator or an administrator.
POST /api/ico/transaction is rate-limited under the platform's order-creation
limiter.
Creator routes
Routes under /api/ico/creator/token/[id] are matched against the caller's
ownership of that offering; a request against somebody else's offering is
refused.
| Method | Path | Does |
|---|---|---|
POST |
/api/ico/creator/launch |
Creates an offering and charges the launch fee |
GET |
/api/ico/creator/launch/plan |
Plans available to launch on |
GET |
/api/ico/creator/token |
The caller's offerings |
GET |
/api/ico/creator/token/[id] |
One of them, in full |
PUT |
/api/ico/creator/token/[id]/plan |
Upgrades the offering to another launch plan |
GET |
/api/ico/creator/stat |
Creator dashboard statistics |
GET |
/api/ico/creator/performance |
Creator chart data |
GET |
/api/ico/creator/investor |
Investors across the caller's offerings |
GET |
/api/ico/creator/token/[id]/release |
Contributions awaiting delivery |
PUT |
/api/ico/creator/token/[id]/release/[transactionId] |
Records a delivery hash for a whole allocation; moves the contribution to VERIFICATION |
GET |
/api/ico/creator/token/[id]/vesting |
Vesting schedules on the offering |
PUT |
/api/ico/creator/token/[id]/vesting/[releaseId] |
Records the hash for one due tranche |
GET POST |
/api/ico/creator/token/[id]/team |
List and add team members |
PUT DELETE |
/api/ico/creator/token/[id]/team/[teamId] |
Edit and remove one |
GET POST |
/api/ico/creator/token/[id]/roadmap |
List and add roadmap items |
PUT DELETE |
/api/ico/creator/token/[id]/roadmap/[roadmapId] |
Edit and remove one |
GET POST |
/api/ico/creator/update |
List and publish project updates |
PUT DELETE |
/api/ico/creator/update/[id] |
Edit and remove one |
The whole-allocation release door refuses a contribution that vests. Team and roadmap additions are refused once the launch plan's cap is reached; update posts are not capped by anything.
Admin routes
| Method | Path | Permission |
|---|---|---|
GET |
/api/admin/ico/stat |
access.ico.stat |
GET |
/api/admin/ico/offer |
view.ico.offer |
POST |
/api/admin/ico/offer/create |
create.ico.offer |
GET |
/api/admin/ico/offer/[id] |
view.ico.offer |
POST |
/api/admin/ico/offer/[id] |
edit.ico.offer |
PUT |
/api/admin/ico/offer/[id] |
edit.ico.offer |
DELETE |
/api/admin/ico/offer/[id] |
delete.ico.offer |
GET |
/api/admin/ico/offer/[id]/funding |
view.ico.offer |
GET |
/api/admin/ico/offer/[id]/transaction |
view.ico.offer |
GET |
/api/admin/ico/offer/[id]/vesting |
view.ico.offer |
POST |
/api/admin/ico/offer/[id]/phase |
edit.ico.offer |
DELETE |
/api/admin/ico/offer/[id]/phase/[phaseId] |
edit.ico.offer |
POST |
/api/admin/ico/offer/[id]/cancel-refund |
manage.system, and the Super Admin role |
GET |
/api/admin/ico/transaction |
view.ico.transaction |
GET |
/api/admin/ico/transaction/[id] |
view.ico.transaction |
POST |
/api/admin/ico/transaction/[id] |
edit.ico.transaction |
GET |
/api/admin/ico/settings/limits |
view.ico.settings + Admin or Super Admin role |
PUT |
/api/admin/ico/settings/limits |
edit.ico.settings + Admin or Super Admin role |
GET POST |
/api/admin/ico/settings/blockchain |
view / edit.ico.settings |
PUT DELETE |
/api/admin/ico/settings/blockchain/[id] |
edit.ico.settings |
PUT |
/api/admin/ico/settings/blockchain/[id]/status |
edit.ico.settings |
GET POST |
/api/admin/ico/settings/token/type |
view / edit.ico.settings |
PUT DELETE |
/api/admin/ico/settings/token/type/[id] |
edit.ico.settings |
PUT |
/api/admin/ico/settings/token/type/[id]/status |
edit.ico.settings |
GET POST PUT |
/api/admin/ico/settings/launch/plan |
view / edit.ico.settings |
PUT DELETE |
/api/admin/ico/settings/launch/plan/[id] |
edit.ico.settings |
PUT |
/api/admin/ico/settings/launch/plan/[id]/status |
edit.ico.settings |
PUT |
/api/admin/ico/settings/launch/plan/[id]/recommanded |
edit.ico.settings |
POST /api/admin/ico/offer/[id] is the moderation endpoint; the action is a
query parameter — approve, reject, flag, unflag, pause or resume.
Rejection requires notes in the body.
POST /api/admin/ico/transaction/[id] is the transaction desk; its action is
also a query parameter — verify, reject, save-note or remove-note.
The "mark as recommended" endpoint is /recommanded. It is a typo in the path
itself, not in this page. Anything calling that endpoint has to use the
misspelling.
Permissions
Fifteen keys ship with core. None are granted to any role by default.
| Key | Used by |
|---|---|
access.ico |
The /admin/ico page |
access.ico.offer |
The offer list and per-status pages |
view.ico.offer |
Offer rows, funding, per-offer transactions and vesting |
create.ico.offer |
The admin create-offering form and endpoint |
edit.ico.offer |
Moderation, editing, phases |
delete.ico.offer |
Deleting an offering |
access.ico.transaction |
The transaction desk and detail pages |
view.ico.transaction |
Transaction rows |
edit.ico.transaction |
Verify, reject, notes |
access.ico.settings |
The settings page |
view.ico.settings |
The investment-limits endpoint |
edit.ico.settings |
All settings writes |
access.ico.stat |
Admin dashboard figures |
create.ico.transaction |
Nothing — seeded but unused |
delete.ico.transaction |
Nothing — seeded but unused |
The emergency cancel additionally requires manage.system.
Settings keys
| Key | Type | Default | Read by |
|---|---|---|---|
icoMinInvestmentAmount |
number | 10 |
The purchase route |
icoMaxInvestmentAmount |
number | 100000 |
The purchase route |
icoMaxPerUser |
number | 50000 |
The purchase route |
icoPlatformFeePercentage |
percent | 0 |
The purchase route |
icoSoftCapPercentage |
percent | 30 |
Settlement |
icoVestingEnabled |
boolean | true |
The launch route |
icoDefaultVestingMonths |
number | 12 |
The launch form |
icoMaintenanceMode |
boolean | false |
The purchase and launch routes |
icoAnnouncementActive |
boolean | false |
The ICO page banner |
icoAnnouncementMessage |
text | empty | The ICO page banner |
icoRefundGracePeriod |
number | 7 |
Nothing — stored and never consulted |
Values are stored as strings. An unset key falls back to the default above, and
a deliberately configured 0 is honoured rather than treated as unset.
Status values
Offerings. PENDING, ACTIVE, REJECTED, SUCCESS, FAILED,
CANCELLED. UPCOMING and DISABLED exist in the schema and in the offer
filters but nothing writes them.
Contributions. PENDING (paid, undelivered), VERIFICATION (delivery
submitted), RELEASED (verified, escrow paid out), REJECTED (delivery
refused, buyer refunded), REFUNDED (swept back by failure, cancellation or a
manual run).
Vesting schedules. ACTIVE, COMPLETED, CANCELLED.
Vesting tranches. PENDING, RELEASED, FAILED, CANCELLED.
Database tables
| Table | Notes |
|---|---|
ico_token_offering |
Soft-deleted; cascades from ico_launch_plan and ico_token_type |
ico_token_detail |
One per offering; carries the vesting terms |
ico_token_offering_phase |
remaining is the live supply figure |
ico_transaction |
notes is JSON — never overwrite it with plain text |
ico_token_vesting |
One per vesting contribution; releaseSchedule snapshots the frozen terms |
ico_token_vesting_release |
One per tranche |
ico_launch_plan |
features is JSON; only the three max* keys are enforced |
ico_blockchain |
value drives address and hash validation |
ico_token_type |
Descriptive only |
ico_team_member |
Capped by the launch plan |
ico_roadmap_item |
Capped by the launch plan |
ico_token_offering_update |
Uncapped |
ico_admin_activity |
The addon's own activity log |
Money amounts are DECIMAL(36,8); percentages on tranches are DECIMAL(5,2).
Cron jobs
Both run hourly, in the cron process, and both report per-run status on Admin → System → Cron.
| Job | Title on the panel | Does |
|---|---|---|
processIcoOfferings |
Process ICO Phases | Activates offerings whose start date has passed; settles ended offerings as SUCCESS or FAILED; refunds every contribution on a failure |
processIcoVestingReleases |
Process ICO Vesting | Announces due tranches once, closes finished schedules, cancels schedules behind refunded contributions |
Settlement runs one database transaction per offering so that one large failed sale cannot block unrelated settlement elsewhere on the platform, and a failure on one offering does not stop the rest of the sweep — but it does mark the run failed, so a red run on the cron panel is real.