# API endpoint map

Root: `https://api.imakefun.com/v1`. JSON request/response; errors include status, title and request ID. Strict body schemas reject unknown fields. UUID resource IDs. The browser sends `credentials: include`; mutating requests send `Origin: https://www.imakefun.com` and authenticated mutations additionally send `X-CSRF-Token`. Select workspace with `X-Workspace-Id`; the API checks membership.

## Implemented

| Method | Path | Access | Behavior |
|---|---|---|---|
| GET | /health/live | public | Process liveness |
| GET | /health/ready | public | Database availability |
| POST | /auth/register | origin + rate limit | email/password/displayName; 202 generic response |
| POST | /auth/verification/request | origin + rate limit | email; request another verification email |
| POST | /auth/verification/confirm | origin + rate limit | token; consume once |
| POST | /auth/password/request | origin + rate limit | email; generic recovery response |
| POST | /auth/password/reset | origin + rate limit | token/password; consume and revoke sessions |
| POST | /auth/login | origin + rate limit | email/password; HttpOnly session cookie + csrfToken |
| GET | /auth/csrf | session | Resume mutation access after reload |
| POST | /auth/logout | session + CSRF | Revoke current session; 204 |
| GET | /auth/sessions | session | Active session IDs/device labels/expiry |
| DELETE | /auth/sessions/:id | session + CSRF | Revoke own session; 204 |
| GET | /users/me | session | Profile and own workspace memberships |
| PATCH | /profiles/me | session + CSRF | displayName/bio; 204 |
| GET | /projects?limit=30&after=UUID | session + workspace | Cursor-paginated active projects |
| POST | /projects | editor + CSRF + workspace | name; creates persisted project; 201 |
| PATCH | /projects/:id | editor + CSRF + workspace | name/version; rejects stale write with 409 |
| DELETE | /projects/:id | editor + CSRF + workspace | Archive project; 204 |

Admin role here means workspace admin only. No public admin APIs exist yet. All responses use no-store and noindex. Known errors: 401 UNAUTHENTICATED/INVALID_CREDENTIALS, 403 FORBIDDEN/CSRF_FAILED/ORIGIN_DENIED, 409 PROJECT_NOT_FOUND_OR_VERSION_CONFLICT, 422 VALIDATION_ERROR, 429 RATE_LIMITED.

## Planned, not implemented

| Resource | Intended operations |
|---|---|
| /auth/oauth/:provider, /auth/mfa, /auth/mobile/* | OIDC, MFA, native rotating tokens |
| /users/me/export, /users/me/deletion | privacy requests |
| /media, /uploads, /uploads/:id/complete | library, constrained uploads, scan completion |
| /images, /videos, /audio, /films | media-type views and creation controls |
| /characters, /storyboards, /scenes | versioned creative documents |
| /models, /quotes | eligible capabilities and server-priced quote |
| /generations/image, /generations/video | moderated, quoted, idempotent job submission; 202 |
| /generations/:id, /jobs/:id, /jobs/:id/cancel | status, reconciliation-aware cancellation |
| /events | authenticated SSE; WebSockets later for collaboration |
| /credits, /credits/transactions | wallet and auditable history |
| /billing/checkout, /billing/portal, /subscriptions, /payments | processor integrations |
| /webhooks/stripe, /webhooks/paypal, /webhooks/providers/:id | verified machine callbacks; exempt browser Origin checks only on these exact signed routes |
| /notifications, /collections, /sharing, /teams | library organization and collaboration |
| /exports, /exports/:id/license | rendered output and license manifest |
| /admin/* | privileged, separately authorized and audited operations |

Do not remove the global browser Origin policy for future webhooks; add a narrowly scoped verified machine-auth exception. No placeholder route reports success for an unimplemented operation.