{"version":"0.1.0","routes":{"categories":{"list":{"path":"/categories","methods":["GET"],"description":"List all available categories"}},"keys":{"list":{"path":"/account/keys","methods":["GET"],"description":"List unlock methods (recovery_code, passphrase) — metadata only"},"kind":{"path":"/account/keys/{kind}","methods":["GET","PUT","DELETE"],"description":"Fetch, upsert, or remove a wrapped master-key blob"},"claim":{"path":"/account/keys/claim","methods":["POST"],"description":"Atomically claim the first wrapped master-key blob"}},"webhooks":{"inbound":{"path":"/webhook/{source}/{capability}/{webhook_id}","methods":["POST"],"description":"Generic webhook bridge - validates the provider's verification token and wakes the user's devices to sync the channel"},"registration":{"path":"/webhook-registrations/{webhook_id}","methods":["PUT","DELETE"],"description":"Upsert or delete a webhook routing registration (client-side watch registration)"},"gmail-push":{"path":"/webhook/gmail/push","methods":["POST"],"description":"Shared-topic Gmail Pub/Sub push - OIDC-verified, routes by mailbox address and wakes the user's devices to sync"}},"sources":{"list":{"path":"/sources","methods":["GET"],"description":"List all sources with embedded capabilities and categories"},"get":{"path":"/sources/{id}","methods":["GET"],"description":"Get a specific source with embedded capabilities and categories"}},"capabilities":{"list":{"path":"/capabilities","methods":["GET"],"description":"List all available capabilities"}},"connections":{"disconnect":{"path":"/connections/{id}/disconnect","methods":["POST"],"description":"Disconnect while preserving the current connection snapshot"},"refresh":{"path":"/connections/{id}/refresh","methods":["POST"],"description":"Refresh OAuth tokens - uses server credentials but returns tokens to client without storing"},"list":{"path":"/connections","methods":["GET","POST"],"description":"List and create connections"},"connect":{"path":"/connections/connect","methods":["POST"],"description":"Exchange OAuth code for tokens - returns tokens to client without storing on server"},"tokens":{"path":"/connections/{id}/tokens","methods":["GET","PUT"],"description":"Get or store client-encrypted OAuth tokens for portable access"},"get":{"path":"/connections/{id}","methods":["GET","PATCH","DELETE"],"description":"Get, update, or permanently destroy a connection"},"initiate":{"path":"/connections/initiate","methods":["POST"],"description":"Initiate OAuth flow - returns OAuth URL for client to open"}},"ai":{"prompts":{"path":"/ai/prompts","methods":["GET"],"description":"List on-device AI prompts (reference data the client syncs into the core)"},"models":{"path":"/ai/models","methods":["POST"],"description":"Query AI models compatible with the requesting device (send device capabilities in body)"}},"suggestions":{"list":{"path":"/suggestions","methods":["GET"],"description":"List ranked suggested integrations for the authenticated user"},"matches":{"path":"/suggestions/matches","methods":["POST"],"description":"Record client-detected detection-pattern matches"},"dismiss":{"path":"/suggestions/{source_slug}/dismiss","methods":["POST","DELETE"],"description":"Dismiss (POST) or undismiss (DELETE) a suggestion for a source"}},"general":{"health":{"path":"/health","methods":["GET"],"description":"Liveness check — is the process up (no dependency probe)"},"readiness":{"path":"/health/ready","methods":["GET"],"description":"Readiness probe — checks database and NATS connectivity (503 if unavailable)"},"index":{"path":"/","methods":["GET"],"description":"API index and documentation"}},"ops":{"push-test":{"path":"/ops/push/test","methods":["GET"],"description":"Operator-only push pipeline test (dry-run by default). Requires ADMIN_API_TOKEN env var and Authorization: Bearer header."},"sentry-test":{"path":"/ops/debug/sentry","methods":["GET"],"description":"Operator-only Sentry self-test: emits a deliberate error to verify capture works. Requires ADMIN_API_TOKEN env var and Authorization: Bearer header."}},"exports":{"status":{"path":"/account/exports/{id}","methods":["GET"],"description":"Get an owned export status"},"download":{"path":"/account/exports/{id}/download","methods":["POST"],"description":"Authenticated short-lived export download"},"authorize":{"path":"/account/exports/{id}/authorize","methods":["POST"],"description":"Issue a short-lived one-time download authorization"},"list":{"path":"/account/exports","methods":["GET","POST"],"description":"List exports or start one after fresh password/TOTP step-up"},"step-up":{"path":"/account/exports/step-up","methods":["POST"],"description":"Create a single-use TOTP challenge for export"}},"account":{"logout":{"path":"/account/logout","methods":["POST"],"description":"Clear session cookies for browser clients"},"problem-reports":{"path":"/account/problem-reports","methods":["POST"],"description":"File an in-app problem report with the device-assembled, customer-approved diagnostic bundle"},"totp-confirm":{"path":"/account/totp/confirm","methods":["POST"],"description":"Confirm TOTP enrollment"},"auth-method-remove":{"path":"/account/auth-methods/{source}","methods":["DELETE"],"description":"Remove one selected sign-in profile after fresh security proof"},"totp-status":{"path":"/account/totp","methods":["GET"],"description":"Get two-step verification status"},"me":{"path":"/account/me","methods":["GET","PATCH","DELETE"],"description":"Get, update, or schedule deletion of the current user (DELETE soft-deletes with a 7-day grace period)"},"totp-enroll":{"path":"/account/totp/enroll","methods":["POST"],"description":"Begin TOTP enrollment"},"email-change-confirm":{"path":"/account/email-change/confirm","methods":["POST"],"description":"Consume an email-verification token plus fresh security proof"},"oauth-method-link":{"path":"/account/auth-methods/{provider}/link","methods":["POST"],"description":"Begin a purpose-bound single-use OAuth login-method link"},"oauth-security-reauth":{"path":"/account/security/reauth/{provider}","methods":["POST"],"description":"Begin purpose-bound provider reauthentication"},"sessions":{"path":"/account/sessions","methods":["GET","DELETE"],"description":"List or revoke all browser sessions"},"totp-challenge":{"path":"/account/totp/challenge","methods":["POST"],"description":"Complete a single-use login two-step challenge"},"panel-login":{"path":"/account/panel-login","methods":["POST"],"description":"Mint a single-use panel auto-login link for the authenticated user (native app → signed-in panel)"},"password-reset-request":{"path":"/account/password-reset/request","methods":["POST"],"description":"Start a password-reset flow by emailing a single-use link to the address on file. Always 204; rate-limited per user."},"password-reset-confirm":{"path":"/account/password-reset/confirm","methods":["POST"],"description":"Complete a password reset by redeeming the token and setting a new password. Invalidates all existing refresh tokens."},"totp-regenerate":{"path":"/account/totp/recovery-codes","methods":["POST"],"description":"Regenerate recovery codes after TOTP step-up"},"cancel-deletion":{"path":"/account/me/cancel-deletion","methods":["POST"],"description":"Cancel a pending account deletion during the grace window"},"totp-disable":{"path":"/account/totp","methods":["DELETE"],"description":"Disable TOTP after step-up"},"deletion-status":{"path":"/account/deletion-status","methods":["GET"],"description":"Read pending-deletion status with a recovery-scoped session"},"auth-methods":{"path":"/account/auth-methods","methods":["GET"],"description":"List non-secret linked sign-in method status"},"refresh":{"path":"/account/refresh","methods":["POST"],"description":"Refresh access token using a valid refresh token (body or HttpOnly cookie)"},"oauth-security-reauth-callback":{"path":"/account/security/reauth/callback","methods":["POST"],"description":"Complete provider reauthentication and issue a one-use proof"},"password-method-add":{"path":"/account/auth-methods/password","methods":["POST"],"description":"Add password sign-in after fresh security proof"},"profiles":{"path":"/account/profiles","methods":["GET"],"description":"List user authentication profiles"},"profiles-key-source":{"path":"/account/profiles/{source}/key","methods":["GET"],"description":"Get encrypted sync key for a specific source profile"},"session":{"path":"/account/sessions/{id}","methods":["DELETE"],"description":"Revoke one browser session"},"profiles-key":{"path":"/account/profiles/key","methods":["GET","POST","PUT"],"description":"Manage encrypted sync key for primary profile (GET: retrieve, POST: create, PUT: update)"},"security-step-up":{"path":"/account/security/step-up","methods":["POST"],"description":"Begin a purpose-bound security-management step-up"},"connect":{"path":"/account/connect","methods":["POST"],"description":"Unified authentication - handles discovery, password auth, OAuth initiation, and OAuth callback all in one endpoint"},"password-change":{"path":"/account/password","methods":["POST"],"description":"Change an existing password after current-password verification; invalidates refresh sessions"},"email-change-request":{"path":"/account/email-change/request","methods":["POST"],"description":"Request a verified canonical email change after fresh security proof"},"oauth-method-callback":{"path":"/account/auth-methods/oauth/callback","methods":["POST"],"description":"Complete an authenticated OAuth login-method link without implicit login linking"},"panel-login-exchange":{"path":"/account/panel-login/exchange","methods":["POST"],"description":"Exchange a panel handoff ticket (from the URL fragment) for a browser session"}},"devices":{"key-response":{"path":"/account/devices/{device_id}/key-response","methods":["POST"],"description":"Existing device posts wrapped master key for requesting device"},"key-transfer":{"path":"/account/devices/{device_id}/key-transfer","methods":["GET"],"description":"New device retrieves and consumes the wrapped master key"},"key-request":{"path":"/account/devices/{device_id}/key-request","methods":["GET","POST"],"description":"Key exchange: POST public key (new device) or GET pending public key (existing device)"},"key-rotation":{"path":"/account/devices/key-rotation","methods":["POST"],"description":"Notify all devices that a key rotation has occurred"},"list":{"path":"/account/devices","methods":["GET","POST"],"description":"List and register devices"},"detail":{"path":"/account/devices/{device_id}","methods":["GET","PUT","DELETE"],"description":"Get, update, or delete a specific device"},"pairing-code":{"path":"/account/devices/{device_id}/pairing-code","methods":["POST"],"description":"Generate a 6-digit pairing code for QR-based device setup"},"push-token":{"path":"/account/devices/{device_id}/push-token","methods":["POST"],"description":"Register or clear push notification token for a device"}},"channels":{"discover":{"path":"/channels/discover","methods":["POST"],"description":"Discover and create channels for a connection"},"list":{"path":"/channels","methods":["GET"],"description":"List channels for a connection (requires ?connection_id=UUID)"},"rename":{"path":"/channels/{id}/rename","methods":["POST"],"description":"Rename a calendar channel on its provider"},"detail":{"path":"/channels/{id}","methods":["GET","PATCH"],"description":"Get or update a specific channel"}},"billing":{"checkout":{"path":"/billing/checkout","methods":["POST"],"description":"Create a Stripe Checkout session for the chosen plan term; returns the hosted URL"},"portal":{"path":"/billing/portal","methods":["POST"],"description":"Create a Stripe Customer Portal session; returns the hosted URL"},"webhook":{"path":"/billing/webhook","methods":["POST"],"description":"Stripe webhook ingest (signature-verified); keeps subscription/invoice state in sync"}}}}