API Reference

Almost every route runs through a security wrapper (apiSecurity.* / withSecurity()) that enforces a rate limit, method/content-type validation, and a body-size cap. Keys are isolated by HTTP method and canonical route pattern; dynamic IDs, query strings, and unrelated endpoints cannot mint or consume one another's buckets. Tiers: public() 30/min no-auth · authenticated() 30/min · admin() 120/min for reads and 30/min for ordinary mutations + is_admin · sensitive admin actions 5/min · ai() 10/min · webhook() 100/min + signature. State-changing requests (POST/PATCH/PUT/DELETE) additionally require CSRF (Origin/Referer + token). Errors return a typed envelope — { "error": "message", "code": "ERROR_CODE" } — with codes from core/*/error-codes.ts (never raw internals). Feature-gated domains (referrals, affiliates, error logs) return 404 when disabled, not 403.

Authentication

Billing

AI

/api/ai/stream uses apiSecurity.ai for Origin/Referer and current-session validation, configured session finalization and active identity resolution. Its two canonical-actor AI buckets precede the bounded JSON parser, preserving the existing Origin-only CSRF policy without a double-submit requirement. SSE and errors are private/no-store. Auth unavailability returns 503; database gate failures return 500 AI_GATE_UNAVAILABLE. Account membership and ai:use remain required, with sessions shared within the Account.

Chat

User

Invitations

Organization

Settings and security-policy handlers require the canonical application actor before parsing or domain effects. Membership denial returns 403; malformed JSON/input returns 400, identity unavailability 503, and database failures 500. Responses are private/no-store. PATCH settings retains its strict rate limit without a new step-up; PUT security-policy retains strict limits and its existing step-up. Policy reads and writes use canonical Account authority through the shared Prisma runtime; mutation audits commit atomically with the change. MFA coverage is an optional, bounded provider diagnostic requested separately from the settings page. Unavailable coverage never relaxes the stored policy. New mandatory policies must include a factor the application can enroll (currently TOTP); passwordless passkeys are separate.

Both organization deletion POSTs accept strictly { accountId }. Remove the former userId field: identity comes from the verified server session, not the request body. They require the configured owner role on a workspace Account; personal Accounts are rejected. Scheduling uses complianceConfig.deletionGraceDays (default 30) and preserves member identities. Existing active requests return 400, including concurrent duplicates. Cancellation removes only pending requests; a 200 no-op does not stop an already processing worker. Both responses are private/no-store, with 400 for invalid input, 403 for denied ownership/type, 503 for unavailable application identity and 500 for database failure.

CMS (Admin)

Jobs

Notifications

API Keys

All methods authorize the canonical application actor as an Account owner/admin. POST and DELETE retain strict rate limiting, CSRF and credentialChange step-up. Handler responses are private/no-store; missing application identity returns 503 before management effects. See API Keys for metadata, failure and one-time secret contracts.

Knowledge Base / Documents (RAG)

Changelog (Admin)

Referrals

Account-centric referral program. Every endpoint returns 404 when REFERRAL_ENABLED is off (surface invisibility).

Affiliates

Cash-commission partner program (distinct from referrals). Every endpoint returns 404 when AFFILIATES_ENABLED is off.

Push Notifications

Error Logs (Admin)

Public & Misc

Admin & Platform

Super-admin surface — all admin-gated (is_admin) and route-scoped: reads allow 120/min/route, ordinary mutations 30/min/route, and sensitive access, billing, role, cron, reversal, or destructive actions retain 5/min/route. State-changing calls require CSRF; sensitive actions also require recent auth where applicable and write immutable audit rows.

Non-admin routes previously grouped here have moved to their correct sections: /api/billing/current-plan → Billing · /api/locale → Public & Misc · /api/org/cancel-deletion → Organizations.