Developers
A REST API with an OpenAPI 3.1 contract. Every endpoint is validated, rate-limited, permission-checked and audited. Errors use RFC 9457 problem+json.
Public endpoints
| Method | Path | What it does |
|---|---|---|
| GET | /api/v1/health | Liveness |
| GET | /api/v1/ready | Readiness: database + job queue |
| GET | /api/v1/status | Public status built from real checks (no fabricated uptime) |
| GET | /api/v1/brands | Public brand registry |
| GET | /api/v1/brands/{slug} | One brand with connections, modules and outcome targets |
| GET | /api/v1/network | Network graph (public nodes + edges) |
| GET | /api/v1/outcomes | Distribution & delivery steps: KPI, target, SLA, evidence |
| GET | /api/v1/settings/public | Public settings (support hours, pricing visibility) |
| GET | /api/v1/jobs | Open jobs |
| POST | /api/v1/inquiries | Submit an inquiry / demo request |
| POST | /api/v1/waitlist | Join a waitlist |
| POST | /api/v1/subscribers | Subscribe (double opt-in) |
| GET | /api/v1/subscribers/confirm | Confirm a subscription |
| GET | /api/v1/subscribers/unsubscribe | One-click unsubscribe (link) |
| POST | /api/v1/subscribers/unsubscribe | One-click unsubscribe (RFC 8058) |
| GET | /api/v1/seo/page | SEO metadata for a path |
| GET | /api/v1/seo/redirect | Resolve a redirect for a path |
| POST | /api/v1/seo/404 | Record a 404 (internal: web server only) |
| GET | /api/v1/seo/sitemap | Sitemap entries (public, indexable pages from the registry) |
| GET | /api/v1/social/profiles | Verified social profiles (feeds footer and sameAs) |
| GET | /api/v1/openapi.json | OpenAPI 3.1 document |
| POST | /api/v1/auth/login | Sign in with email + password (+ TOTP when MFA is enabled) |
| POST | /api/v1/auth/logout | Sign out |
| GET | /api/v1/auth/session | Current session, roles, permissions and CSRF token |
| POST | /api/v1/auth/mfa/setup | Start TOTP enrolment (returns secret + otpauth URL) |
| POST | /api/v1/auth/mfa/verify | Verify a TOTP code (completes enrolment or step-up) |
| POST | /api/v1/auth/reauth | Re-authenticate (password + TOTP) for sensitive actions |
| POST | /api/v1/auth/password | Change password |
| GET | /api/v1/search | Global command search (brands, pages, docs, tickets when permitted) |
| POST | /api/v1/elysian/chat | Ask Elysian (public or signed-in mode) |
Conventions
- Authentication
- Session cookie (HttpOnly, Secure, SameSite=Lax) with MFA for administrative scopes.
- CSRF
- Send X-CSRF-Token from GET /api/v1/auth/session on unsafe methods; requests must come from the site origin.
- Idempotency
- Idempotency-Key on ticket creation and exports (24 h window).
- Rate limits
- Public form posts: 5 per minute and 50 per day per address.