Specview Base — 55 endpoints (copy openapi.yaml verbatim)
| Method | Path | Purpose | Auth |
|---|---|---|---|
GET | /api/health | Health check | — |
GET | /api/health/neon | Neon DB connectivity check | — |
GET | /api/health/stripe | Stripe connectivity check | — |
GET | /api/health/security | Security headers check | — |
POST | /api/auth/register | Register new user | — |
POST | /api/auth/login | Login, returns JWT | — |
GET | /api/auth/me | Get current user | Bearer JWT |
POST | /api/auth/refresh | Refresh JWT token | Bearer JWT |
GET | /api/billing/status | Get subscription status | Bearer JWT |
POST | /api/billing/create-checkout-session | Create Stripe checkout | Bearer JWT |
GET | /api/billing/verify-session | Verify checkout completed | Bearer JWT |
POST | /api/billing/webhook | Stripe webhook receiver | Stripe-Signature |
POST | /api/billing/portal | Customer portal session | Bearer JWT |
GET | /api/projects | List user's projects | Bearer JWT |
POST | /api/projects | Create project | Bearer JWT |
GET | /api/projects/{id} | Get project | Bearer JWT |
DELETE | /api/projects/{id} | Delete project | Bearer JWT |
POST | /api/projects/{id}/coherence | Check spec coherence | Bearer JWT |
PUT | /api/projects/{id}/files/{filename} | Save file | Bearer JWT |
GET | /api/projects/{project_id}/files/{filename}/history | File history | Bearer JWT |
GET | /api/projects/{project_id}/files/{filename}/diff | File diff | Bearer JWT |
POST | /api/projects/{project_id}/files/{filename}/revert | Revert file | Bearer JWT |
POST | /api/projects/{id}/repair | AI repair spec | Bearer JWT |
POST | /api/projects/{id}/share | Share project (slug) | Bearer JWT |
POST | /api/projects/{id}/claim | Claim shared project | Bearer JWT |
POST | /api/projects/{project_id}/generate-task | Generate task | Bearer JWT |
GET | /api/projects/{project_id}/generate-task/status | Task poll | Bearer JWT |
POST | /api/projects/{project_id}/cancel | Cancel generation | Bearer JWT |
POST | /api/projects/{project_id}/regenerate-task | Regen task | Bearer JWT |
GET | /api/context/{key} | Get context value | Bearer JWT |
PUT | /api/context/{key} | Set context value | Bearer JWT |
POST | /api/ai/text/generate-spec | Generate full spec | Bearer JWT |
POST | /api/ai/text/iterate | Iterate on section | Bearer JWT |
POST | /api/ai/text/bootstrap-project | Bootstrap project (async) | Bearer JWT |
GET | /api/ai/text/bootstrap-project/status/{job_id} | Poll bootstrap | Bearer JWT |
POST | /api/ai/text/bootstrap-project/{job_id}/cancel | Cancel bootstrap | Bearer JWT |
POST | /api/ai/text/bootstrap-project/{job_id}/retry | Retry bootstrap | Bearer JWT |
POST | /api/ai/text/anonymous/bootstrap-project | Anonymous bootstrap | — |
GET | /api/ai/text/anonymous/bootstrap-project/status/{job_id} | Poll anon bootstrap | — |
GET | /api/ai/stats | AI usage stats | Bearer JWT |
POST | /api/expand | Expand text | Bearer JWT |
POST | /api/compress | Compress text | Bearer JWT |
POST | /api/clarify | Clarify text | Bearer JWT |
POST | /api/simplify | Simplify text | Bearer JWT |
POST | /api/tldr | TL;DR summary | Bearer JWT |
POST | /api/bullets | Bullet list | Bearer JWT |
POST | /api/brainstorm | Brainstorm ideas | Bearer JWT |
POST | /api/rewrite | Rewrite text (doc-editing, JSON) | Bearer JWT |
POST | /api/spec-gen/generate | Spec generation | Bearer JWT |
GET | /api/templates/spec-index | Spec templates index | Bearer JWT |
GET | /api/templates/readme | README template | Bearer JWT |
POST | /api/templates/timeline | Timeline template | Bearer JWT |
POST | /api/public/analyze | Public braindump analyze | — |
GET | /api/public/analyze/{job_id} | Poll public analyze | — |
GET | /api/public/share/{slug} | Get shared spec | — |
+ Photoshoot (bubls → Replicate LoRA)
| Method | Path | Purpose | Auth |
|---|---|---|---|
GET,POST | /api/photoshoot/generate | Generate AI headshots via Replicate LoRA | Bearer JWT |
GET | /api/photoshoot/active-model | Get the active LoRA model | Bearer JWT |
GET | /api/photoshoot/history | Photoshoot history for user | Bearer JWT |
+ Text Operations (bubls streaming humanize + chains)
| Method | Path | Purpose | Auth |
|---|---|---|---|
POST | /api/text/rewrite/stream | Stream-humanize text (text/plain chunks) | Bearer JWT |
POST | /api/text/chain | Run a text transformation chain | Bearer JWT |
POST | /api/text/chain/import | Import a custom text chain | Bearer JWT |
+ User / Track / Waitlist (bubls)
| Method | Path | Purpose | Auth |
|---|---|---|---|
POST | /api/user/onboarding/skip | Skip onboarding | Bearer JWT |
PUT | /api/user/builder | Update builder profile | Bearer JWT |
POST | /api/user/entitlements | Sync payment entitlements | Bearer JWT |
POST | /api/track | Track analytics event | Bearer JWT |
GET | /api/track/verdict | Analytics verdict | Bearer JWT |
POST | /api/waitlist/signup | Add to waitlist | — |
+ Interview Sessions (intervai → Tavus CVI)
| Method | Path | Purpose | Auth |
|---|---|---|---|
POST | /api/sessions | Create interview session (Tavus CVI) | Bearer JWT |
GET | /api/sessions/{session_id} | Get session | Bearer JWT |
POST | /api/sessions/{session_id}/end | End session | Bearer JWT |
POST | /api/sessions/{session_id}/report | Generate AI report | Bearer JWT |
GET | /api/sessions/{session_id}/report | Get report | Bearer JWT |
POST | /api/demo/start | Start demo session | — |
POST | /api/webhooks/tavus | Tavus webhook (auto-report) | Tavus-Signature |
GET | /api/config | Frontend config / feature flags | — |
+ Usage Meter (humanize-me)
| Method | Path | Purpose | Auth |
|---|---|---|---|
GET | /api/usage | Current user daily usage count | Bearer JWT |
Conflicts
/api/rewrite vs /api/text/rewrite/stream
specview has generic doc-editing /api/rewrite (JSON); humanize/bubls need /api/text/rewrite/stream (streaming text/plain). Keep both — different namespace and response type.
resolved/api/billing/* vs /api/stripe/* vs /api/checkout and /api/portal
intervai uses /api/stripe/checkout + /api/stripe/portal; humanize uses /api/checkout + /api/portal. Normalise all to /api/billing/* (specview spine). One Stripe account, one billing module.
resolvedJWT auth (/api/auth/*) vs Supabase cookies (humanize)
specview JWT is the canonical auth. humanize migrates: supabase.auth.getSession() → Capacitor Preferences storage adapter, pass JWT as Bearer to Flask. Medium effort, required for Capacitor/mobile.
pending3 Decisions — Auth · Billing · Rewrite
1. Auth — specview JWT wins
All products use POST /api/auth/register + POST /api/auth/login (specview spine, HS256 JWT). humanize-me migrates off Supabase cookies: swap createBrowserClient → createClient with a Capacitor Preferences storage adapter. The Supabase Postgres tables (texts, user_usage) are still queried via a thin Flask passthrough so the shell stays JWT-only.
2. Billing — one /api/billing/* namespace
All checkout/webhook/portal flows normalised to /api/billing/* (specview module). Each product passes a product_key param to the checkout endpoint so one webhook handler routes to the right entitlement. One oll.am Stripe account. Revenue aggregates on TrustMRR automatically.
POST /api/billing/create-checkout-session
Body: { "price_id": "price_...", "product_key": "photoshoot|humanize|spec|interview" }
POST /api/billing/webhook
Header: Stripe-Signature
Body: routes on product_key in metadata3. Rewrite — two coexisting endpoints
Keep both — they do different things:POST /api/rewrite — specview doc-editing rewrite, JSON request/response.POST /api/text/rewrite/stream — bubls/humanize streaming humanizer, returns text/plain chunks (raw concatenated, NOT SSE). Angular reads via fetch + getReader() + TextDecoder.