Skip to main content

​
Workflow

EndpointMethodRole
/api/ideaPOSTSubmit idea → analysis and clarifying questions
/api/intentPOSTSubmit answers → refined requirements
/api/platformPOSTGet platform options and recommendation
/api/paymentPOSTValidate Solana wallet/balance before payment
/api/executePOSTRun X402 execution after payment

​
Payment (Dodo)

EndpointMethodRole
/api/dodo/create-checkoutPOSTCreate Dodo checkout session
/api/dodo/confirm-paymentPOSTConfirm Dodo payment (optional)
/api/dodo/webhookPOSTDodo webhook (payment.succeeded, etc.)

​
Projects / GitHub

EndpointMethodRole
/api/projects/downloadGETDownload project ZIP
/api/projects/generatePOSTTrigger (re)generation
/api/github/authorize, /callback, /upload, /statusGET/POSTGitHub OAuth and push

​
Admin

EndpointMethodRole
/api/admin/workflowsGETList workflows
/api/admin/agentsGETAgent stats
/api/admin/agent-controlPOSTEnable/disable agents
/api/admin/transactionsGETList transactions
/api/admin/usersGETList users
/api/admin/paymentsGETPayments overview
/api/admin/treasuryGETTreasury/balance
/api/admin/filesGETFiles/deliverables
/api/admin/download-fileGETDownload a file

​
Other

EndpointMethodRole
/api/payment/configGETPayment config (e.g. UNIFIED_PRICE_SCRIPT)
/api/support/ticketsPOSTCreate support ticket
/api/user/registerPOSTRegister user (e.g. by wallet)
/api/test/script-tokenGETTest SCRIPT token / wallet
/api/test/a2aGETTest A2A communication

​
Authentication

  • Workflow and payment: No auth; the sessionId ties requests to a Workflow. For payment, the client sends userWalletPubKey (Solana) or completes Dodo checkout; the server validates balance or webhook.
  • Admin: Handlers do not implement auth. In production you must add API keys, JWT, or role checks and protect /api/admin/* (and optionally Dodo webhook with DODO_WEBHOOK_SECRET).
  • GitHub: OAuth via /api/github/authorize and /api/github/callback; GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, GITHUB_CALLBACK_URL.

​
Rate Limiting

  • Not implemented in the codebase. For production, consider:
    • General: upstash-rate-limit or similar per IP / sessionId.
    • AI: limit concurrent execute and Idea/Intent/Platform to avoid OpenRouter quota issues.
    • Dodo webhook: optional throttling to avoid duplicate handling.

​
Error Handling

​
HTTP Status

CodeUsage
200Success (including payment payment_issues and some webhook acks)
400Bad request: missing/invalid body, missing context, invalid signature
401Unauthorized (e.g. invalid Dodo webhook signature)
405Method not allowed
500Server/DB/AI error
503Service unavailable (e.g. agents disabled in Execute)

​
Response Shape (Typical)

Success 
{ "status": "success", "sessionId": "...", "stage": "...", ... }
Error 
{ "status": "error", "stage": "...", "error": "Human-readable message" }
Some endpoints add error even when returning 200 (e.g. payment payment_issues).

​
Versioning

  • No URL or header versioning (e.g. /v1/idea). Changes are backwards-compatible where possible.
  • To introduce versions: add a path prefix or Accept/X-API-Version and route to different handlers.