API Documentation

One platform. Explicit company boundaries.

A starting reference for developers working with the supplied UNFD application. The current API serves the first-party workspace; a public partner API and API-key program are not available.

Route conventions

Every authenticated company request uses an explicit, registered workspace slug. An unknown workspace does not fall back to another company.

GET /api/platform
GET /api/t/{workspace}/auth/me
GET /api/t/{workspace}/bootstrap
PUT /api/t/{workspace}/tenant/branding

Authentication and authorization

Sign-in creates a company-scoped HttpOnly session cookie. State-changing company requests also require the CSRF token issued by that session. Tenant branding changes require an administrator role and a current branding revision. Never send provider secrets or credentials through a public marketing form.

Public platform endpoints

Endpoint	Purpose
`GET /api/platform`	Public UNFD identity and demo-mode information.
`GET /api/marketing/config`	Hosted demo scheduling configuration and preview status.
`POST /api/marketing/inquiries`	Retired (410). Demo appointments are booked on Google’s booking page instead.

Before building a connector

Review the route handlers, shared schemas, provider permissions, and automated tests in the code package. External integrations need an agreed authorization and support model before production use.

Discuss an integration