Endpoints

POST /api/ask

Public audit-page Q&A. It answers grounded only on StackTracker's tool-audit data.

• Method: POST only.
• Auth: none (public). Rate-limited to 10 requests / 60s per IP.
• Requires: server env DEEPSEEK_API_KEY. Returns 503 if absent.

Request body:

{ "question": "string (max 300 chars)", "category": "string (optional)" }

Response:

{ "answer": "string" }

Errors:

POST /api/chat

Authenticated in-app analyst. Context is the signed-in user's own projects (totals, ratios, upcoming renewals).

• Method: POST only.
• Auth: required (Supabase user session). Returns 401 if not signed in. Rate-limited 10 / 60s per user.
• Requires: DEEPSEEK_API_KEY.

Request body. The last 6 turns of history are used:

{
  "question": "string (max 500 chars)",
  "history": [{ "role": "user | assistant", "content": "string" }]
}

Response:

{ "answer": "string" }

Errors: 503, 401, 429, 400, 502.

POST /api/webhooks/revenuecat?project=<slug>

Inbound RevenueCat webhook.

• Method: POST only.
• Auth: a per-project shared secret. You must pass ?project=<slug>. The server looks up that project's stored RevenueCat secret and compares it to the Authorization: Bearer <secret> header.

Errors:

Request body: a RevenueCat event. Only these event types create a revenue entry:

• INITIAL_PURCHASE
• RENEWAL
• NON_RENEWING_PURCHASE
• UNCANCELLATION

Other event types are ignored.

Response on success. A revenue entry with source revenuecat is created, deduped on the event id:

{ "ok": true }

Response for skipped events:

{ "ignored": "..." }

GET /api/mail/callback/[provider]

Mail OAuth step-2 callback. You do not call this directly. It is the redirect target after granting access.

• Method: GET.
• provider: gmail or outlook.

It verifies the ?state against a cookie, exchanges the ?code for tokens, stores an encrypted mail connection, then redirects (302) to /settings/connections?connected=1. On failure it redirects with an ?error= value.