API Reference

57 HTTP endpoints across 14 categories. All endpoints accept and return JSON.

Authentication

Public endpoints require no authentication. Protected endpoints require one of:

  • Session cookie (__Host-session in secure production; tr_session for direct-HTTP development) — set by the login flow
  • Biscuit token — Authorization: Bearer <token>
  • Guest session — via POST /auth/guest-login

Health

Public
MethodPathDescription
GET/healthLiveness check
GET/readyReadiness check (database + sync)

Auth

Public
MethodPathDescription
GET/auth/loginInitiate OIDC login flow (?provider=google|github, ?return_to=/path)
GET/auth/callbackOIDC callback handler
POST/auth/logoutDestroy session
GET/auth/userinfoCurrent user profile
POST/auth/refreshRefresh access token
POST/auth/export-keyExport encryption key
POST/auth/guest-loginCreate anonymous guest session

Catalog

Public
MethodPathDescription
GET/api/v1/catalog/appsList all apps
GET/api/v1/catalog/apps/{id}Get app by ID
GET/api/v1/catalog/apps/by-slug/{slug}Get app by slug
GET/api/v1/catalog/modelpacksList model packs
GET/api/v1/catalog/modelpacks/{id}Get model pack by ID

Blog

Public
MethodPathDescription
GET/api/v1/blog/postsList blog posts
GET/api/v1/blog/posts/{slug}Get post by slug
GET/api/v1/blog/categoriesList categories
GET/api/v1/blog/categories/{slug}/postsPosts in category

Documents

Protected
MethodPathDescription
GET/api/v1/documentsList user documents
POST/api/v1/documentsCreate document
GET/api/v1/documents/{id}Get document
PUT/api/v1/documents/{id}Update document
DELETE/api/v1/documents/{id}Delete document
POST/api/v1/documents/{id}/archiveArchive document
POST/api/v1/documents/{id}/unarchiveUnarchive document

Device Pairing

Protected
MethodPathDescription
POST/api/v1/devices/{user_id}/pair/generateGenerate pairing QR
POST/api/v1/devices/{user_id}/pair/processProcess scanned QR
POST/api/v1/devices/{user_id}/pair/completeComplete pairing
GET/api/v1/devices/{user_id}List paired devices
DELETE/api/v1/devices/{user_id}/{device_id}Revoke device

File Sync

Protected
MethodPathDescription
POST/api/v1/filesync/uploadLegacy endpoint disabled; use filesync-v2
GET/api/v1/filesync/download/{user_id}/{file_id}Legacy endpoint disabled; use filesync-v2
GET/api/v1/filesync/filesList files
POST/api/v1/filesync/sync/{tier}Legacy endpoint disabled; use filesync-v2
GET/api/v1/filesync/usageLegacy endpoint disabled; use filesync-v2
GET/api/v1/filesync/statusLegacy endpoint disabled; use filesync-v2
DELETE/api/v1/filesync/files/{file_id}Delete file

CRDT Time Travel Preview

Protected
MethodPathDescription
GET/api/v1/timetravel/{doc_id}/checkpointsList owned CRDT checkpoints
POST/api/v1/timetravel/{doc_id}/checkpointsCreate owned CRDT checkpoint
POST/api/v1/timetravel/{doc_id}/travel/{cp_id}Restore owned CRDT checkpoint
POST/api/v1/timetravel/{doc_id}/headReturn CRDT state to head
GET/api/v1/timetravel/{doc_id}/frontiersGet current CRDT frontiers

API Keys

Protected
MethodPathDescription
GET/api/v1/apikeys/{user_id}List API keys
POST/api/v1/apikeys/{user_id}Create API key
GET/api/v1/apikeys/{user_id}/{key_id}Get API key
DELETE/api/v1/apikeys/{user_id}/{key_id}Revoke API key
POST/api/v1/apikeys/{user_id}/{key_id}/rotateRotate API key
POST/api/v1/apikeys/validateValidate API key

Cloud Launch

Protected
MethodPathDescription
POST/api/v1/cloud/launch/{app_id}/contextPrepare launch authorization
POST/api/v1/cloud/launch/{app_id}Launch cloud instance
GET/api/v1/cloud/instancesList instances
POST/api/v1/cloud/instances/{id}/stopStop instance
GET/api/v1/cloud/instances/{id}/statusInstance status

Billing

Protected
MethodPathDescription
POST/api/v1/billing/checkoutCreate checkout session
GET/api/v1/billing/portalBilling portal URL
GET/api/v1/billing/subscriptionCurrent subscription
GET/api/v1/billing/invoicesList invoices