API overview

Authentication

POST /api/auth/login with {slug, email, password} returns a session token as an HttpOnly cookie and in the body for bearer use. MFA-enabled workspaces require the second-factor step first. Sessions expire; call login again for a fresh token.

Tenancy and scope

Every request resolves the caller's tenant automatically. You never pass a tenant ID - your account's data is the only data reachable, enforced in the query layer and again by Postgres row-level security.

Conventions

• Bodies are JSON.
• PATCH /api/:kind/:id partially updates tickets, conversations or members.
• POST /api/:kind/:id/delete performs deletions.
• Errors return { "message": "...", "statusCode": n }: 400 validation, 401 unauthenticated, 403 forbidden, 404 not found, 409 conflict.
• Mutations emit audit events; notifications and automation are side effects, not part of the response.

Rate limits

Content types

Channel callbacks use form-encoded or XML as each provider dictates and are verified by signature or shared secret, not session.