app/api/.
Base URL
Authentication
Every route except/api/auth/* (which is the auth system) requires a valid
session cookie — the same cookie your browser holds after signing in. There is no
separate API-key auth for these routes; they’re meant to be called from the app’s own
frontend, not as a public API.
An unauthenticated request gets:
401.
Errors
Routes return a JSON body with anerror string on failure, and sometimes a code
field for errors the frontend needs to branch on (for example,
anthropic_not_configured). There’s no single global error envelope beyond that — check
each endpoint’s reference page for its specific error shapes.
Endpoints
Authentication
Sign-up, sign-in, sessions, organizations, invitations — handled by better-auth.
Intake
Extract structured search criteria from free text or a job description.
Credentials
Manage encrypted API keys for downstream providers.