API Documentation

Base URL

Authentication

The API uses HTTPOnly session cookies for authentication. No API keys required.

1. Sign in via the web interface
2. Session cookie is automatically included in requests
3. Cookie expires after 30 days of inactivity

CSRF Protection

All state-changing requests (POST, PUT, DELETE, PATCH) require CSRF tokens:

// 1. Get token
const response = await fetch('/api/csrf');
const { token, headerName } = await response.json();

// 2. Include in request
fetch('/api/jobs', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    [headerName]: token
  },
  body: JSON.stringify({ ... })
});

Rate Limits

• • Anonymous: 10 requests/minute
• • Authenticated: 100 requests/minute
• • AI endpoints: 20 requests/hour

Error Responses

All errors follow this format:

{
  "error": "Human-readable error message",
  "code": "MACHINE_READABLE_CODE",
  "details": { ... }
}