API Routes

Routes live in sable-agents-demo/web/api. This page is the original flat index; the API Reference section covers chat, approvals, prompt control, inbound email, portfolio, documents, availability/calendar, admin/environment/costs, and feedback in family-by-family depth, including routes not listed in the table below.

Route	Methods	Purpose	Auth
/api/config	GET	Public browser config	Public; returns public Supabase URL/anon only
/api/spine	GET	Scoped spine payload	Supabase JWT in live mode
/api/chat	POST	Ask SABLE scoped Q&A	Supabase JWT in live mode; legacy token only in demo mode
/api/search	POST	Scoped knowledge search over chunks	Supabase JWT
/api/doc	GET	Signed document URL	Supabase JWT
/api/doc-upload-session	POST	Allocate document row and signed upload token	Supabase JWT
/api/document-inventory	GET	Admin indexed-doc and contract-extraction inventory	Supabase JWT; admin/lead
/api/inbox	GET	Pending approval cards	Supabase JWT in live mode
/api/approvals	GET, POST	Approval list/mutate/execute	Supabase JWT; writes admin/lead
/api/sable-prompt	POST	Lead-only prompt read, stage, promote, history, and rollback bridge	Supabase JWT; admin/lead
/api/outcome	GET	Outcome estimate	Supabase if configured
/api/estimate-cases	POST	Persist an outcome estimate case	Supabase JWT; admin/lead
/api/updates/draft	POST	Create a weekly/client update approval draft	Supabase JWT; admin/lead
/api/deliverable-drafts	POST	Generate an evidence-backed deliverable draft + approval	Supabase JWT; admin/lead
/api/client-portal	GET/POST	Curated client portal payload, request intake, audited access prep	Supabase JWT
/api/whoami	GET	Current viewer	Supabase JWT
/api/board	GET	Legacy CMA board HTML	Demo-only; disabled in production mode
/api/ingest	POST	Legacy transcript-drop CMA run	Demo-only; disabled in production mode
/api/status	GET	Legacy CMA session status	Demo-only; disabled in production mode
/api/fathom-webhook	POST	Legacy CMA-memory webhook	Demo-only shared secret
/api/ingest-doc	POST	Extract, chunk, embed, and index an uploaded document	Supabase JWT

In SABLE_MODE=production, routes with no Supabase configuration fail closed instead of serving bundled demo JSON or CMA memory-store data.

Approval Route Actions

{ "action": "approve", "id": "approval-uuid" }

{ "action": "approve_and_execute", "id": "approval-uuid" }

{ "action": "reject", "id": "approval-uuid", "reason": "not needed" }

{ "action": "edit", "id": "approval-uuid", "payload": { "text": "Edited" } }

{ "action": "batch_approve", "ids": ["approval-uuid"] }

{ "action": "execute", "id": "approval-uuid" }

Only asana_task_create approvals execute external writes today. weekly_update, scope_change, sow_draft, client_readout, and deliverable_release mutate only SABLE-owned portal tables. prompt_update folds approved learned rules into the live agent prompt. email_draft, scope_flag, and sow_estimate remain approval/audit records until their delivery paths are implemented.

Prompt Control Route Actions

{ "action": "get_prompt" }

{ "action": "stage_prompt", "base": "candidate base prompt" }

{ "action": "set_base_prompt", "base": "approved base prompt" }

{ "action": "prompt_versions" }

{ "action": "rollback_prompt", "version_row_id": "version-row-uuid" }

POST /api/deliverable-drafts accepts optional authoring_profile_id or profile_key. When present, the route applies the profile's section requirements, source collection policy, standing facts, client-facing language rubric, canonical target, and revision-history rules. Canonical export details are returned and stored as metadata; the route still queues approval only and does not overwrite external files.

Outcome Response Shape

{
  "query": "hubspot migration",
  "no_data": false,
  "typical_hours": 150,
  "range_hours": [100, 200],
  "duration_weeks": [8, 12],
  "category": "crm_migration",
  "budget_variance_hours": { "average": 5, "range": [-10, 20] },
  "financials": {
    "average_margin_percent": 46,
    "average_revenue": 21500,
    "average_cost": 11700
  },
  "confidence": "Medium",
  "comparables": [],
  "scope_signals": {
    "completed_after_hours": [],
    "recent_burn_hours": 12.5
  },
  "assumptions": []
}