BOUNDED API PILOT

A clear contract
for your workflow.

Health and account-status endpoints are available now. One-record extraction is implemented for authenticated same-origin browser sessions and fails closed until production storage, credentials and the live-processing switch are configured.

Check service health

GET /v1/health

{"status":"ok","mode":"demonstration"}

This endpoint needs no authentication and returns a non-cacheable JSON response. Unsupported API paths return a JSON 404.

OpenAPI description

Account sessions

GET /v1/account returns login availability and the current account when signed in. Browser login uses POST /auth/login. Logout uses POST /auth/logout with the session cookie and an X-CSRF-Token header from account status. These mutations require the application Origin.

Extract one enquiry

POST /v1/extractions
Content-Type: application/json
X-CSRF-Token: <account session token>
Idempotency-Key: <8–128 safe characters>

{"message":"Customer enquiry text"}

Messages are limited to 8,000 characters. Pilot limits are three admitted requests per minute, ten per UTC day and one hundred per UTC month per tenant. Successful rows include source evidence, missing-field indicators, safe usage metadata and an X-Request-ID. Source text and validated results expire after seven days.

Planned public API

Bearer API keys and billing are not part of this pilot. They will reuse the website's monthly record allowance and idempotent structured errors after their security and billing gates are implemented.

Inspect the result format