GET/bootstrap/statusCheck whether first-owner setup is available
OpenAPI 3.1 · API 1.0.0
The Node/SQLite Compose profile and Cloudflare D1/R2 profile expose the same organization-scoped API and synchronization behavior.
Browser clients use secure opaque sessions and rotating CSRF tokens. Long-lived bearer tokens are not stored in the browser.
GET/bootstrap/statusCheck whether first-owner setup is available
POST/bootstrapCreate the first owner and family
POST/auth/sign-inStart a secure browser session
POST/auth/recoverConsume a recovery code and replace the account password
GET/sessionRotate and read the current authenticated session
POST/session/revoke-othersRevoke every other session for the current user
POST/auth/sign-outRevoke the current session
GET/membersList active members in the current family
DELETE/members/{membershipId}Remove a non-owner family member and revoke their sessions
GET/invitationsList unexpired pending invitations for the current family
POST/invitationsCreate an expiring family invitation
DELETE/invitations/{invitationId}Revoke a pending invitation
POST/invitations/{invitationId}/replaceRevoke a pending invitation and create a replacement link
POST/invitations/acceptAccept a family invitation
POST/sync/pushApply an ordered idempotent mutation batch
GET/sync/pullRead organization changes after an opaque cursor
GET/resources/{type}List active records of one resource type
GET/resources/{type}/{id}Read one active organization-scoped record
GET/media/{id}/contentDownload authorized original image
PUT/media/{id}/contentUpload and integrity-check original image
DELETE/media/{id}/contentDelete private image content
PUT/media/{id}/thumbnailUpload an authorized JPEG thumbnail
GET/export/fullDownload structured data, CSV files, and original media
POST/import/fullRestore the workspace from a full export archive, replacing current records