API shape
Application endpoints live under /api. Most require an authenticated owner session and same-origin mutation requests. The API validates input and returns an error object for rejected requests. Use the browser application for normal work; this reference is for integration and testing.
Main routes
- GET /api/auth/session: current session and user state.
- POST /api/auth/register, /api/auth/resend, /api/auth/verify, /api/auth/complete-signup: work-email verification followed by account creation. Verification returns a single-use grant, not a session.
- POST /api/auth/password-reset, /api/auth/reset-password: request a recovery code, then save a new password using its verified grant. See accounts and security.
- POST /api/auth/login, /api/auth/logout: session lifecycle.
- GET /api/state: owner-scoped companies, Pods, provider status and recent audit items.
- POST /api/companies; PUT /api/companies/:id: save a draft or update a company. Activation validates required onboarding information.
- GET/POST /api/companies/:id/knowledge: list or upload company files.
- GET /api/companies/:id/research: read the latest saved report.
- POST /api/companies/:id/research: enqueue research; returns HTTP 202 with a persisted job.
- GET /api/companies/:id/research/status: recover the latest job, progress, result and any error.
- POST /api/companies/:id/pods: create a Pod from an active company.
- POST /api/pods/:id/run, /pause, /decision: control work and record human decisions.
- GET /api/pods/:id/download: download the Markdown result.
- GET/POST /api/mcp/servers: manage discovered MCP endpoints through the company-scoped API.
Safety and versioning
Company edits use version checks. API callers must supply valid company-owned IDs for selected files and Pods. Do not treat documented paths as permission to bypass the application’s authentication and review flow.