What you can call, and what it guarantees.
Written for whoever has to decide whether this is a system or a prompt with a logo. The endpoint list below is the real surface. The section under it describes how output is kept trustworthy, which is the part that actually matters.
Auth. Bearer token from POST /auth/login. Scoped to one organisation; a token cannot reach another org's data.
Idempotency. Every write accepts an Idempotency-Key. A repeat replays the stored response; the same key with a different body is a 409; a failed request releases the key so a retry works.
Errors. A stable machine code, a human message, and a correlation id echoed in the x-correlation-id header.
Where a model is allowed to be wrong, and where it is not.
An agent that is confidently wrong about a compliance obligation moves money. These are the constraints that make that survivable.
Deterministic rules run first, and always persist
Requirement extraction is rule-based and runs on every turn over the entire transcript. Its output is stored before any model is consulted. A rule that misses a signal leaves a visible gap the customer can correct; a model that silently invents one moves money.
The model adds, it does not overrule
A model is then asked for a second opinion against a JSON schema, and merged additively above a confidence floor. It can add a signal the rules missed. It cannot remove one they found, and cannot change the classification when the rules had direct evidence. Every signal is stored with its provenance and the phrase that produced it.
Structured output is validated, not trusted
Model responses are parsed and validated against a schema. An invalid response is retried once with the validation error fed back, and a second failure is discarded rather than passed downstream. Repaired responses carry a lower confidence score than first-pass ones.
Money and gates are code, not prompts
Pricing is a pure function over stored requirements. The contract, payment and kickoff gates are explicit state machines with the illegal transitions enumerated. No model participates in deciding whether work may start.
Credentials never reach a model
Every outbound prompt is scanned for API keys, cloud access keys, tokens, private keys, connection strings and card numbers, and redacted before the call leaves the process.
Everything is reconstructible
Requirements, estimates and contracts are versioned. Each carries the input that produced it and a confidence score, so a decision made months ago can be explained rather than defended.
What we do not publish
Accuracy, precision and recall figures, because they are meaningless without the dataset they were measured on and we will not quote a number you cannot check. What we will do is agree the acceptance thresholds for your project in the statement of work, before work starts, and measure against them on your data. That is in the contract rather than on a slide.
The whole surface.
Grouped by the stage they belong to. Notes call out the behaviour that will surprise you, not the behaviour the path already implies.
Auth
Sessions are stateless bearer tokens. SSO is stubbed pending an identity provider.
/auth/loginExchange email and password for a session token.
/auth/sso/redirectBegin an SSO flow.
Returns 501 until an identity provider is configured for your deployment.
/auth/sso/callbackComplete an SSO flow and provision the user on first sight.
/auth/logoutRecord a logout.
Advisory. Tokens are stateless, so discard client-side; server-side revocation needs a blocklist.
/meThe authenticated user and their organisation.
Intake
Chat-first requirement capture. Every turn re-extracts over the whole transcript and persists the result.
/intakesOpen an intake session and its project.
/intakes/:idSession state, message history and the latest extracted requirements.
/intakes/:id/messagesSend a message. Returns the reply and the classification.
Requirements are persisted before the reply is generated, so a dropped connection never loses the extracted scope.
/intakes/:id/streamThe same turn over SSE.
Emits a classification event first, then token events, then done. The message is a query parameter because EventSource cannot send a body.
/intakes/:id/classifyRe-read the stored classification without adding a message.
/intakes/:id/finalizeLock requirements so an estimate can be issued against a stable scope.
Requirements
Prerequisite schemas are served by the API so the form is generated from one definition.
/schemas/cv_prereqsJSON Schema for vision prerequisites.
/schemas/rag_prereqsJSON Schema for retrieval prerequisites.
/projects/:id/cv_prereqsSave vision prerequisite answers.
Answers augment what intake extracted; they never replace it. Rejected once requirements are locked by a contract.
/projects/:id/rag_prereqsSave retrieval prerequisite answers.
Estimates
Pricing is computed server-side from stored requirements. There is no field for an amount.
/projects/:id/estimatePrice the project. Body carries configuration only: agents, add-ons, billing term.
Supplying a price in the body changes nothing. Asserted by test.
/projects/:id/estimateThe current estimate with its complexity drivers.
Contracts
The statement of work is generated server-side, versioned, and issued for signature.
/projects/:id/contractGenerate the SOW and open a signature envelope.
Approves and freezes the estimate. Refuses if a contract is already out for signature.
/projects/:id/contractContract status, envelope reference and the document itself.
Payment
Status changes only ever arrive by signed webhook. A client cannot mark itself paid.
/projects/:id/checkoutOpen a checkout for the approved amount.
Refuses while the contract is unsigned, and while another payment is in flight. The amount comes from the estimate, not the request.
/projects/:id/paymentsPayment history for the project.
Delivery
Work cannot begin until the contract is signed and payment has cleared.
/projects/:id/kickoffStart delivery and queue the task list.
Returns 409 KICKOFF_BLOCKED with the blockers named until both gates pass.
/projects/:id/tasksThe delivery task list with its owning agent.
/projects/:id/deployStart a deployment to a target.
Targets: onprem, aws, azure, gcp, edge.
/projects/:id/telemetryHealth, progress and the gate state.
/projectsProjects in your organisation.
/projects/:idEverything about one project in a single read.
Connectors and audit
Credentials are sealed per organisation. Every consequential action is recorded.
/projects/:id/connectorsStore a connector credential, encrypted.
Refuses rather than storing plaintext if no vault key is configured. The secret never appears in the audit log.
/auditThe audit trail for your organisation.
Webhooks
Unauthenticated but signature-verified. Verification is constant-time over the raw request bytes.
/webhooks/esignSignature provider events.
Replay-safe: an event that would not change state returns success rather than an error.
/webhooks/paymentPayment provider events.
The only way a payment reaches SUCCEEDED.
Operational
/healthStatus, database driver and which providers are configured.
Names every active stand-in, so a deployment never has to guess whether it is talking to a real payment provider.
Including where nothing can leave.
The platform is packaged for Docker and Kubernetes, with offline bundles for environments that have no outbound connectivity. Self-hosted models are available where no traffic may reach a third party at all.