API reference

Base URL

All endpoints are served under a single, versioned base path. v1 is stable and will not break.

/api/v1

Authentication

Requests are authenticated with a short-lived access token issued at sign-in and sent as an HTTP-only cookie. Expired tokens are refreshed automatically.

Response format

Every response uses the same envelope. Successful responses carry a data payload (and meta for lists); errors carry a stable code and a human-readable message.

{
  "success": true,
  "message": "OK",
  "data": { },
  "meta": { "page": 1, "pageSize": 20, "total": 42 }
}

{
  "success": false,
  "code": "VALIDATION_ERROR",
  "message": "The request could not be processed."
}

Conventions

• Pagination?page=1&pageSize=20
• Filtering?filter[status]=active
• Sorting?sort=createdAt:desc

Common endpoints

This is a representative subset. The full, always-current reference lands with the public API.