Skip to content
ScopeKite

API overview

REST under /v1, defined once in packages/schemas/src/contract.ts (a Zod operation registry) → generated OpenAPI 3.1 + typed client. pnpm check:api fails CI when generated output drifts.

  • Auth: session cookie (web, same-origin proxy) or bearer (mobile).
  • Conventions: error envelope with stable codes and request IDs; cursor pagination; Idempotency-Key on creates; baseRevision compare-and-set on updates (409 → authoritative current).
  • Tenancy: every route under /v1/workspaces/{ws}/… resolves membership first; non-members receive 404s (existence is never leaked). New tenant endpoints must register in the negative-auth test registry or the suite fails.
  • Non-JSON routes (attachment download, CSV export) are guarded the same way and set Content-Disposition + nosniff.
  • Contract changes are additive only within v0.x, one version bump per changing PR (currently v0.15.0).

Where to change it: registry + dto in packages/schemas, then pnpm generate:api, then the controller/service/repository in apps/api, then the mobile fixtures — and run turbo run test --force (the cache once masked a fixture break; TEST_STRATEGY codifies this).