Find browser API routes

Routes live in web/api. This page is the original flat index; the API Reference section covers chat, approvals, prompt control, inbound email, portfolio, documents, availability/calendar, admin/environment/costs, and feedback in family-by-family depth. The customer portal API covers the complete workspace, access, review, file, plan, notification, and assistant contracts.

Route	Methods	Purpose	Auth
/api/config	GET	Public browser config	Public; returns public Supabase URL/anon only
/api/spine	GET	Scoped spine payload	Supabase JWT in live mode
/api/chat	POST	Ask SABLE scoped Q&A	Supabase JWT in live mode; legacy token only in demo mode
/api/search	POST	Scoped knowledge search over chunks	Supabase JWT
/api/doc	GET	Signed document URL	Supabase JWT
/api/doc-upload-session	POST	Allocate document row and signed upload token	Supabase JWT
/api/document-inventory	GET	Admin indexed-doc and contract-extraction inventory	Supabase JWT; admin/lead
/api/meeting-delete	GET, POST	Preview and confirm permanent meeting deletion; read minimal status/history receipts	Supabase JWT; organization admin
/api/inbox	GET	Pending approval cards	Supabase JWT in live mode
/api/client-contacts	POST	Save a client-level contact from an email draft card (action: save), or remove one (action: remove)	Supabase JWT; save: a lead or anyone on a project for the client; remove: a lead or the person who saved it
/api/gmail-draft	POST	Save a chat email draft to the signed-in person's own Gmail Drafts (forwards to the gmail-draft Edge function; never sends)	Supabase JWT; staff; refused under View as someone else
/api/email-draft-review	POST	File a chat email draft as a pending email_draft approval ("Send for review"); sends nothing	Supabase JWT; any signed-in person, on projects they can see
/api/approvals	GET, POST	Approval list/mutate/execute	Supabase JWT; writes admin/lead
/api/sable-prompt	POST	Lead-only prompt read, stage, promote, history, and rollback bridge	Supabase JWT; admin/lead
/api/outcome	GET	Outcome estimate	Supabase if configured
/api/estimate-cases	POST	Persist an outcome estimate case	Supabase JWT; admin/lead
/api/updates/draft	POST	Create a weekly/client update approval draft	Supabase JWT; admin/lead
/api/deliverable-drafts	GET, POST	Load scoped drafts or generate an evidence-backed deliverable draft and approval	Supabase JWT; admin/lead
/api/client-portal	GET, POST	Scoped portal workspace plus request and internal-note mutations	Supabase JWT; staff actions require exact scope
/api/portal-access	GET, POST	Membership roster, invitation, resend, recovery, and revocation	Supabase JWT; admin/lead
/api/portal-assistant	POST	Answer from authorized released workspace evidence	Supabase JWT
/api/portal-attachments	GET, POST	Prepare, validate, complete, and download private request files	Supabase JWT; request scope
/api/portal-files	GET, POST	GET ?download=: a 60-second download link for a shared document the portal shows the viewer; POST: prepare and complete a customer upload to a current project's Library	Supabase JWT; client scope and project; downloads re-checked with list_portal_resources
/api/portal-milestones	POST	Create or update customer-visible shared milestones	Supabase JWT; scoped staff
/api/portal-notifications	GET, POST, PUT	Person-scoped inbox, read state, and notification preferences	Supabase JWT; current client scope
/api/portal-publications	GET, POST	Staff publication inventory, explicit resource share/withdraw, and direct customer updates	Supabase JWT; staff browse, admin/lead writes
/api/portal-links	GET, POST, PUT, DELETE	Important links for a customer: list, add, edit or reorder (PUT), archive (DELETE)	Supabase JWT; read by admin/lead or a customer member of the client (consultants cannot read links), writes admin/lead
/api/portal-preparation	GET, PUT, POST	Starter-package preparation. With section=policy, reads (GET) and saves (PUT) the client's tabs, landing tab, auto-share, recording-link, weekly-draft and backfill settings; POST is not allowed for the policy section	Supabase JWT; preparation read and save by scoped staff (admin, lead, or a consultant on one of the client's active projects), apply (POST) admin/lead, policy read and write admin/lead
/api/deliverable-release	POST	Recheck approved source-draft QA and create one immutable current portal version, review state, receipt, and notifications	Supabase JWT; admin/lead
/api/deliverable-reviews	POST	Comment on or decide one current released version	Supabase JWT; decision capability required for approve/change requests
/api/whoami	GET	Current viewer	Supabase JWT
/api/board	GET	Legacy CMA board HTML	Demo-only; disabled in production mode
/api/ingest	POST	Legacy transcript-drop CMA run	Demo-only; disabled in production mode
/api/status	GET	Legacy CMA session status	Demo-only; disabled in production mode
/api/fathom-webhook	POST	Legacy CMA-memory webhook	Demo-only shared secret
/api/ingest-doc	POST	Extract, chunk, embed, and index an uploaded document	Supabase JWT

In SABLE_MODE=production, routes with no Supabase configuration fail closed instead of serving bundled demo JSON or CMA memory-store data.

Meeting deletion route

GET /api/meeting-delete?source_id=<uuid> returns meeting identity, provider, an opaque snapshot token, dependency counts and explicit consequences. It never returns the transcript, attendee list or provider URL. POST /api/meeting-delete confirms the current preview:

{
  "action": "confirm",
  "source_id": "meeting-source-uuid",
  "expected_version": "opaque-preview-token",
  "reason_code": "private_recording",
  "acknowledge_content_redaction": true
}

Valid reasons are private_recording, accidental_import, duplicate and other. The server takes organization and actor only from the verified session, and the database verifies both again. A stale snapshot returns 409; cross-organization and absent meetings both return 404. Completion is synchronous and atomic. GET ?receipt_id=<uuid> reads one minimal receipt and GET ?history=1 returns the newest organization receipts. There is no deletion retry action or provider deletion call in this route.

When the preview counts linked task, decision or promise redactions, or a deliverable, brief, summary, artifact, document, obligation, status update or board withdrawal, the dialog requires an additional acknowledgment. Linked operational rows keep their identity/status shells while their text, people and URLs are redacted. Affected mixed-source draft bodies are fully withdrawn and must be rebuilt from the remaining sources; their unrelated evidence links and relationships remain. The confirm RPC enforces this boolean against its locked dependency snapshot, so a direct API call cannot bypass the acknowledgment.

Approval Route Actions

{ "action": "approve", "id": "approval-uuid" }

{ "action": "approve_and_execute", "id": "approval-uuid" }

{ "action": "reject", "id": "approval-uuid", "reason": "not needed" }

{ "action": "edit", "id": "approval-uuid", "payload": { "text": "Edited" } }

{ "action": "batch_approve", "ids": ["approval-uuid"] }

{ "action": "execute", "id": "approval-uuid" }

Only asana_task_create approvals execute external writes today. weekly_update, scope_change, sow_draft, and client_readout mutate only SABLE-owned tables. Approved deliverable drafts normally require a separate admin/lead Release to client action in Draft Workbench, which calls /api/deliverable-release and creates the immutable portal version. Approving a legacy deliverable_release record invokes the same gated immutable release through release_deliverable_approval_to_portal; it does not merely flip base visibility. prompt_update folds approved learned rules into the live agent prompt. email_draft, scope_flag, and sow_estimate remain approval/audit records until their delivery paths are implemented.

Prompt Control Route Actions

{ "action": "get_prompt" }

{ "action": "stage_prompt", "base": "candidate base prompt" }

{ "action": "set_base_prompt", "base": "approved base prompt" }

{ "action": "prompt_versions" }

{ "action": "rollback_prompt", "version_row_id": "version-row-uuid" }

POST /api/deliverable-drafts accepts optional authoring_profile_id or profile_key. When present, the route applies the profile's section requirements, source collection policy, standing facts, client-facing language rubric, canonical target, and revision-history rules. Canonical export details are returned and stored as metadata; the route still queues approval only and does not overwrite external files.

Outcome Response Shape

{
  "query": "hubspot migration",
  "no_data": false,
  "typical_hours": 150,
  "range_hours": [100, 200],
  "duration_weeks": [8, 12],
  "category": "crm_migration",
  "budget_variance_hours": { "average": 5, "range": [-10, 20] },
  "financials": {
    "average_margin_percent": 46,
    "average_revenue": 21500,
    "average_cost": 11700
  },
  "confidence": "Medium",
  "comparables": [],
  "scope_signals": {
    "completed_after_hours": [],
    "recent_burn_hours": 12.5
  },
  "assumptions": []
}