Skip to content
AppHandoff AppHandoff Docs

REST API reference

AppHandoff API 2.0.0

Section titled “AppHandoff API 2.0.0”

Build in Lovable. Bots plan. You approve. Kanban ships it.

Projects, handoffs, and MCP context (handoff tickets, project coordination). First-party portal operations require a Supabase session. MCP uses OAuth, while Context Capture uses its project-bound private ticket credential.

Information

Operations

Section titled “ Operations ”
GET
/auth/status
POST
/auth/logout
POST
/auth/dev-login
POST
/auth/exchange-supabase-token
GET
/auth/github
POST
/auth/login
GET
/auth/me
POST
/auth/refresh
POST
/auth/send-password-reset
POST
/auth/send-magic-link
POST
/auth/signup
GET
/projects/{id}/github-sync-health
POST
/projects/{id}/github-sync-health
POST
/projects/{id}/assistant/chat
GET
/projects/{id}/prioritization
POST
/projects/{id}/prioritization/derive
GET
/projects/{id}/prioritization/progress
GET
/github/repos
GET
/github/status
GET
/github/connection
GET
/github/app/install-url
GET
/github/app/install/callback
POST
/github/app/install/complete
POST
/github/app/uninstall
GET
/projects/{id}/github-sync-health
POST
/projects/{id}/github-sync-health
POST
/stripe/checkout
POST
/stripe/portal
GET
/billing/insights
GET
/billing/plan
POST
/team/invitations/accept/{token}
POST
/admin/seed-ticket-embeddings
GET
/health
GET
/health/metrics
GET
/health/deep
GET
/health/ping
GET
/health/public
GET
/version
GET
/uptime
GET
/mcp-bot
POST
/mcp-bot
DELETE
/mcp-bot
OPTIONS
/mcp-bot
GET
/mcp-bot/health
OPTIONS
/mcp-bot/health
GET
/mcp-bot/public-health
OPTIONS
/mcp-bot/public-health
GET
/mcp-bot/ping
GET
/mcp-bot/tools
OPTIONS
/mcp-bot/tools
GET
/mcp/status
OPTIONS
/mcp/status
GET
/mcp/ping
OPTIONS
/mcp/ping
GET
/oauth/authorize
GET
/oauth/loopback-callback
POST
/oauth/token
OPTIONS
/oauth/token
POST
/oauth/mcp-inspector/token
OPTIONS
/oauth/mcp-inspector/token
POST
/oauth/consent
GET
/oauth/consent/context
POST
/oauth/decision
GET
/oauth/authorize
GET
/oauth/loopback-callback
POST
/oauth/register
OPTIONS
/oauth/register
POST
/oauth/token
OPTIONS
/oauth/token
POST
/oauth/mcp-inspector/token
OPTIONS
/oauth/mcp-inspector/token
GET
/integrations/wispr/client-metadata
POST
/cron/backfill-handoff-complete
POST
/cron/deploy-health
POST
/cron/db-error-spike
POST
/cron/milestone-summaries
POST
/cron/milestone-merge-sync
POST
/cron/program-chat
GET
/cron/github-sync-repair
POST
/cron/github-sync-repair
GET
/cron/inbound-email
POST
/cron/inbound-email
GET
/cron/stale-in-progress
POST
/cron/stale-in-progress
GET
/cron/merge-backstop
POST
/cron/merge-backstop
GET
/cron/ticket-email-digest
POST
/cron/ticket-email-digest
GET
/cron/signup-notify
POST
/cron/signup-notify
GET
/cron/activation-notify
POST
/cron/activation-notify
GET
/cron/stalled-signup-nudge
POST
/cron/stalled-signup-nudge
POST
/inbound-email
POST
/webhooks/github
POST
/webhooks/stripe
POST
/webhooks/cursor-agent
POST
/webhooks/slipstream/deploy
GET
/board/plan
POST
/board/sync-plan
GET
/debug
POST
/dev/events
OPTIONS
/dev/events
GET
/dev/sessions
OPTIONS
/dev/sessions
GET
/integrations/webhooks/status
GET
/openapi.json
GET
/program-agent/{sessionId}/events
GET
/trpc/{trpc}
POST
/trpc/{trpc}
POST
/agents/machines/heartbeat
POST
/agents/runs/{id}/events
GET
/surveys/{code}
POST
/surveys/{code}/responses
POST
/integrations/context-capture/v1/tickets
GET
/integrations/context-capture/v1/projects
GET
/integrations/context-capture/v1/tickets/{ticketId}
PATCH
/integrations/context-capture/v1/tickets/{ticketId}
GET
/slack/app/install-url
GET
/slack/app/install/callback
POST
/slack/app/events
GET
/email/unsubscribe/{token}
POST
/email/unsubscribe/{token}

Authentication

Section titled “ Authentication ”

contextCaptureCredential

Section titled “contextCaptureCredential ”

Project-bound Context Capture credential.

Security scheme type: http

Bearer format: ah_cc project credential

portalSessionBearer

Section titled “portalSessionBearer ”

First-party portal Supabase session token.

Security scheme type: http

Bearer format: Supabase access token

mcpBearer

Section titled “mcpBearer ”

OAuth access token for the MCP resource. A missing or rejected token is answered 401 with WWW-Authenticate resource_metadata pointing at /.well-known/oauth-protected-resource/mcp.

Security scheme type: http

Bearer format: MCP OAuth access token

cookieAuth

Section titled “cookieAuth ”

Supabase session cookie (web UI).

Security scheme type: apiKey

Cookie parameter name: sb-access-token