capybaraAPI details and current boundaries
A reference for the application's existing session-authenticated routes.
There is no public API-key system, published OpenAPI contract, or promised stable external API today. These routes support the dashboard and may change. This page documents what exists; it does not grant access.
Authentication and origin
Protected requests require a verified signed-in account and the application's HTTP-only session cookie. Requests are restricted to the application host. Write requests check the request origin, permissions, and input validation. Administrator routes additionally require the administrator role.
Existing routes
| Method | Path | Purpose |
|---|---|---|
| GET | /api/health | Database-backed health check; no login needed. |
| GET | /api/overview | Links, available domains, metrics, appearance, and pagination. |
| POST | /api/links | Create a redirect or page within account permissions. |
| GET / PATCH | /api/links/:id | Read or update an owned link. |
| PUT | /api/links/:id/page | Save a page draft or publish it. |
| GET | /api/links/:id/qr | Generate a PNG or SVG QR code. |
| GET | /api/links/export | CSV export, respecting search and domain filters. |
| GET | /api/analytics | Aggregate activity for the signed-in user. |
| GET | /api/account/export | Private account data export. |
A read-only example
From the signed-in application origin, a same-origin request can read the current user's overview. Do not paste session cookies into scripts, documentation, or third-party tools.
const response = await fetch('/api/overview?page=1', {
credentials: 'same-origin'
});
if (!response.ok) throw new Error('Request failed');
const { links, pagination } = await response.json();Errors and pagination
Unauthenticated protected requests return 401. Permissions can produce 403, missing resources 404, conflicting state 409, invalid input 400, and rate limits 429. The overview accepts page, q, and domain query parameters and returns pagination with page, page_size, and total.
External automation
Use account exports for portable data today. Do not build a production integration around private cookies or undocumented writes. A versioned public API and developer tokens would need a separate supported release.