API Reference
57 HTTP endpoints across 14 categories. All endpoints accept and return JSON.
Authentication
Public endpoints require no authentication. Protected endpoints require one of:
- Session cookie (
__Host-sessionin secure production;tr_sessionfor direct-HTTP development) — set by the login flow - Biscuit token —
Authorization: Bearer <token> - Guest session — via
POST /auth/guest-login
Health
Public| Method | Path | Description |
|---|---|---|
| GET | /health | Liveness check |
| GET | /ready | Readiness check (database + sync) |
Auth
Public| Method | Path | Description |
|---|---|---|
| GET | /auth/login | Initiate OIDC login flow (?provider=google|github, ?return_to=/path) |
| GET | /auth/callback | OIDC callback handler |
| POST | /auth/logout | Destroy session |
| GET | /auth/userinfo | Current user profile |
| POST | /auth/refresh | Refresh access token |
| POST | /auth/export-key | Export encryption key |
| POST | /auth/guest-login | Create anonymous guest session |
Catalog
Public| Method | Path | Description |
|---|---|---|
| GET | /api/v1/catalog/apps | List all apps |
| GET | /api/v1/catalog/apps/{id} | Get app by ID |
| GET | /api/v1/catalog/apps/by-slug/{slug} | Get app by slug |
| GET | /api/v1/catalog/modelpacks | List model packs |
| GET | /api/v1/catalog/modelpacks/{id} | Get model pack by ID |
Blog
Public| Method | Path | Description |
|---|---|---|
| GET | /api/v1/blog/posts | List blog posts |
| GET | /api/v1/blog/posts/{slug} | Get post by slug |
| GET | /api/v1/blog/categories | List categories |
| GET | /api/v1/blog/categories/{slug}/posts | Posts in category |
Documents
Protected| Method | Path | Description |
|---|---|---|
| GET | /api/v1/documents | List user documents |
| POST | /api/v1/documents | Create document |
| GET | /api/v1/documents/{id} | Get document |
| PUT | /api/v1/documents/{id} | Update document |
| DELETE | /api/v1/documents/{id} | Delete document |
| POST | /api/v1/documents/{id}/archive | Archive document |
| POST | /api/v1/documents/{id}/unarchive | Unarchive document |
Device Pairing
Protected| Method | Path | Description |
|---|---|---|
| POST | /api/v1/devices/{user_id}/pair/generate | Generate pairing QR |
| POST | /api/v1/devices/{user_id}/pair/process | Process scanned QR |
| POST | /api/v1/devices/{user_id}/pair/complete | Complete pairing |
| GET | /api/v1/devices/{user_id} | List paired devices |
| DELETE | /api/v1/devices/{user_id}/{device_id} | Revoke device |
File Sync
Protected| Method | Path | Description |
|---|---|---|
| POST | /api/v1/filesync/upload | Legacy endpoint disabled; use filesync-v2 |
| GET | /api/v1/filesync/download/{user_id}/{file_id} | Legacy endpoint disabled; use filesync-v2 |
| GET | /api/v1/filesync/files | List files |
| POST | /api/v1/filesync/sync/{tier} | Legacy endpoint disabled; use filesync-v2 |
| GET | /api/v1/filesync/usage | Legacy endpoint disabled; use filesync-v2 |
| GET | /api/v1/filesync/status | Legacy endpoint disabled; use filesync-v2 |
| DELETE | /api/v1/filesync/files/{file_id} | Delete file |
CRDT Time Travel Preview
Protected| Method | Path | Description |
|---|---|---|
| GET | /api/v1/timetravel/{doc_id}/checkpoints | List owned CRDT checkpoints |
| POST | /api/v1/timetravel/{doc_id}/checkpoints | Create owned CRDT checkpoint |
| POST | /api/v1/timetravel/{doc_id}/travel/{cp_id} | Restore owned CRDT checkpoint |
| POST | /api/v1/timetravel/{doc_id}/head | Return CRDT state to head |
| GET | /api/v1/timetravel/{doc_id}/frontiers | Get current CRDT frontiers |
API Keys
Protected| Method | Path | Description |
|---|---|---|
| GET | /api/v1/apikeys/{user_id} | List API keys |
| POST | /api/v1/apikeys/{user_id} | Create API key |
| GET | /api/v1/apikeys/{user_id}/{key_id} | Get API key |
| DELETE | /api/v1/apikeys/{user_id}/{key_id} | Revoke API key |
| POST | /api/v1/apikeys/{user_id}/{key_id}/rotate | Rotate API key |
| POST | /api/v1/apikeys/validate | Validate API key |
Cloud Launch
Protected| Method | Path | Description |
|---|---|---|
| POST | /api/v1/cloud/launch/{app_id}/context | Prepare launch authorization |
| POST | /api/v1/cloud/launch/{app_id} | Launch cloud instance |
| GET | /api/v1/cloud/instances | List instances |
| POST | /api/v1/cloud/instances/{id}/stop | Stop instance |
| GET | /api/v1/cloud/instances/{id}/status | Instance status |
Billing
Protected| Method | Path | Description |
|---|---|---|
| POST | /api/v1/billing/checkout | Create checkout session |
| GET | /api/v1/billing/portal | Billing portal URL |
| GET | /api/v1/billing/subscription | Current subscription |
| GET | /api/v1/billing/invoices | List invoices |