HTTP API
The endpoints these pages talk to. The same contract is spelled out, with request and response bodies, in src/site/BACKEND.md.
Authentication
Session endpoints set an HttpOnly cookie and are called by the browser. Everything else takes Authorization: Bearer <token>.
| Method | Path | Purpose |
|---|---|---|
| POST | /api/auth/register | Creates an account, starts a session. |
| POST | /api/auth/login | Starts a session. |
| POST | /api/auth/logout | Ends it. |
| GET | /api/auth/github/start | Redirects into the OAuth flow. |
Content
Each page can ask for a fresher version of itself. The payload is the page’s content document — DocsContent or AuthContent — and anything that fails validation is ignored, so a bad deploy leaves the built-in page standing.
| Method | Path | Returns |
|---|---|---|
| GET | /api/docs/:pageId | DocsContent |
| GET | /api/auth/page/:mode | AuthContent |
Errors
A rejected submission is 422 with a body the form can render in place. field names an input; omit it for a form-level message.
{ "ok": false, "errors": [ { "field": "email", "message": "That address is already registered." }, { "message": "Check the highlighted fields." } ]}