Internal endpoint inventory - video2ctx

These routes are documented for transparency and maintainers. They are intentionally excluded from the interactive API playground.

This page is generated from platform/src/openapi.ts and the exhaustive audience map. Do not edit it by hand.

First-party application operations

Called by the video2ctx web application or an explicit signed-in account action.

Method	Path	Operation ID	Summary	Declared access	Safety notes
`POST`	`/api/auth/api-key/create`	`createApiKey`	Create a permanent API key	`sessionCookie` or `demoUser`	Creates a secret credential; expose the returned key once and keep it out of logs and client storage.
`POST`	`/api/auth/api-key/delete`	`deleteApiKey`	Revoke an API key	`sessionCookie` or `demoUser`	Immediately revokes the selected credential; require an explicit user action.
`GET`	`/api/auth/api-key/list`	`listApiKeys`	List the current user’s API keys	`sessionCookie` or `demoUser`	Returns credential metadata; restrict it to the current signed-in account.
`GET`	`/api/auth/device`	`verifyDeviceAuthorization`	Claim a device code in the browser	`sessionCookie`	Claims a short-lived user code for the signed-in browser account; show the account and requested access before a decision.
`POST`	`/api/auth/device/approve`	`approveDeviceAuthorization`	Approve a claimed device code	`sessionCookie`	Issues CLI access after an explicit browser decision; approve only a code the user initiated on a device they control.
`POST`	`/api/auth/device/deny`	`denyDeviceAuthorization`	Deny a claimed device code	`sessionCookie`	Terminates the pending device request selected by the signed-in user without issuing a credential.
`GET`	`/api/auth/get-session`	`getAuthSession`	Get the current Better Auth session	`sessionCookie` or `cliSession`	Returns the current credential identity; never include raw cookie or bearer material in the response or logs.
`POST`	`/api/auth/sign-in/magic-link`	`signInWithMagicLink`	Send a magic sign-in link	Public or protocol-signed	Sends account email; rate-limit callers and never disclose whether an address is registered.
`POST`	`/api/auth/sign-in/social`	`signInWithSocialProvider`	Start Google sign-in	Public or protocol-signed	Starts an interactive browser sign-in; do not call it with API-key credentials.
`POST`	`/api/auth/sign-out`	`signOut`	Revoke the current browser or CLI session	`sessionCookie` or `cliSession`	Revokes the presented session; invoke it only for an explicit logout action and clear the matching local credential after success.
`DELETE`	`/v1/account`	`deleteAccount`	Permanently delete the current account	`sessionCookie` or `demoUser`	Destructive account operation; require deliberate confirmation and never automate it for a user.
`GET`	`/v1/admin/agent-traces`	`listAdminAgentTraces`	Find diagnostic agent runs	`sessionCookie`	Administrative diagnostics across user sessions; require a live verified admin browser session.
`GET`	`/v1/admin/agent-traces/{runId}`	`getAdminAgentTraceRun`	List a run’s diagnostic tool attempts	`sessionCookie`	Administrative tool-attempt metadata; require a live verified admin browser session.
`GET`	`/v1/admin/agent-traces/{runId}/calls/{traceId}`	`getAdminAgentToolTrace`	Inspect complete tool arguments and result	`sessionCookie`	Contains full private tool arguments and results; require a live verified admin browser session and never cache responses.
`GET`	`/v1/admin/agent-traces/{runId}/export`	`exportAdminAgentTrace`	Export an ordered diagnostic timeline	`sessionCookie`	Downloads private diagnostic payloads; require a live verified admin browser session. Export never executes tools.
`GET`	`/v1/billing`	`getBilling`	Get the signed-in account billing status	`sessionCookie`	Returns subscription state for the current browser account; do not expose another customer’s provider identifiers.
`POST`	`/v1/demo/youtube/inspect`	`inspectLandingYouTubeVideo`	Inspect a YouTube video from the landing page	Public or protocol-signed	Public, rate-limited demo route; do not use it as a credentialed bulk-data API.
`POST`	`/v1/notification-preferences/confirm-email`	`confirmNotificationEmail`	Confirm monitor email alerts from the signed-in dashboard	`sessionCookie` or `cliSession` or `bearerApiKey` or `apiKey` or `demoUser`	Enables email delivery only for the signed-in account after validating the confirmation token.
`DELETE`	`/v1/oauth/youtube`	`disconnectYouTube`	Disconnect the YouTube account	`sessionCookie` or `demoUser`	Mutates the account connection state; require an explicit user action.
`GET`	`/v1/oauth/youtube/connect`	`createYouTubeConnectUrl`	Create a YouTube OAuth URL	`sessionCookie` or `demoUser`	Returns a state-bound OAuth URL; start it only from a user-initiated connection flow.
`PUT`	`/v1/onboarding`	`saveOnboardingAnswers`	Save the signed-in account onboarding answers	`sessionCookie`	Browser-session only. Records the signed-in account’s own onboarding answers; never accept a user ID from the caller.
`POST`	`/v1/projects/{id}/sources`	`linkProjectSource`	Add a saved Sources search or inspection to a project	`sessionCookie` or `demoUser`	Browser-session only. Verify that the project and saved source belong to the same signed-in user before linking shared asset references.
`GET`	`/v1/projects/{id}/sources/{itemId}`	`getProjectSource`	Restore a project source snapshot	`sessionCookie` or `demoUser`	Browser-session only. Verify project ownership and restore the item from that project without modifying saved references.
`GET`	`/v1/projects/{id}/sources/items/{itemId}`	`openProjectItem`	Open any saved project item from storage	`sessionCookie` or `demoUser`	Browser-session only. Verify project and item ownership; restore from storage without provider requests, credits or writes, and only within the user’s saved evidence.
`PUT`	`/v1/projects/{id}/sources/items/{itemId}/snapshot`	`pinProjectItemSnapshot`	Retain saved data for a project item	`sessionCookie` or `demoUser`	Browser-session only. Verify the owned item identity; copy an exact owned Recent or project revision or resolve already-stored data, never client-supplied R2 keys.
`POST`	`/v1/projects/{projectId}/answers`	`createAnswer`	Generate a cited answer	`sessionCookie` or `demoUser`	Internal research implementation under refinement. Browser-session only; API keys and CLI sessions are rejected. Reserves 12 credits and charges 10 on success.
`POST`	`/v1/projects/{projectId}/comparisons`	`createComparison`	Compare private research sources	`sessionCookie` or `demoUser`	Internal research implementation under refinement. Browser-session only; API keys and CLI sessions are rejected. Reserves 24 credits and charges 20 on success.
`POST`	`/v1/projects/{projectId}/reports`	`createReport`	Generate an evidence-first report	`sessionCookie` or `demoUser`	Internal research implementation under refinement. Browser-session only; API keys and CLI sessions are rejected. Reserves 40 credits and charges 32 on success.
`POST`	`/v1/resolve`	`resolveInput`	Route universal UI input	`sessionCookie` or `cliSession` or `bearerApiKey` or `apiKey` or `demoUser`	First-party input router; its dispatch behavior is not a stable public API contract.
`POST`	`/v1/scale-inquiries`	`submitScaleInquiry`	Submit a Scale plan inquiry	Public or protocol-signed	Public lead form; validate Turnstile and rate limits, and never let the caller choose the notification recipient.
`GET`	`/v1/sources/recent`	`listRecentSources`	List recent Sources inputs	`sessionCookie` or `demoUser`	Browser-session only. Lists inputs belonging to the authenticated user without exposing shared asset references.
`POST`	`/v1/sources/recent`	`saveRecentSource`	Remember a Sources search or inspection	`sessionCookie` or `demoUser`	Browser-session only. Resolves existing provider assets server-side; never accepts client-supplied R2 keys or video payloads.
`GET`	`/v1/sources/recent/{id}`	`getRecentSource`	Restore saved Sources data	`sessionCookie` or `demoUser`	Browser-session only. Verifies user ownership before reading the saved shared references.
`POST`	`/v1/sources/recent/{id}/comments`	`appendRecentSourceComments`	Retain another fetched comments page	`sessionCookie` or `demoUser`	Browser-session only. Verify the owned revision and continuation chain; retain an already-stored comments page without provider calls or credits. Optional project links verify ownership.

Callbacks and signed links

Called by an external provider or through a signed link with protocol-specific state.

Method	Path	Operation ID	Summary	Declared access	Safety notes
`GET`	`/v1/email/unsubscribe`	`unsubscribeEmail`	Unsubscribe from email digests	Public or protocol-signed	A signed link changes email preferences; do not expose or reuse its token.
`POST`	`/v1/email/unsubscribe`	`unsubscribeEmailPost`	Unsubscribe from email digests	Public or protocol-signed	Changes email preferences; validate the signed request and avoid logging its token.
`GET`	`/v1/oauth/youtube/callback`	`completeYouTubeOAuth`	Complete YouTube OAuth	Public or protocol-signed	OAuth callback; validate state and consume authorization codes only once.

Operator operations

Reserved for authorized video2ctx platform administration.

Method	Path	Operation ID	Summary	Declared access	Safety notes
`GET`	`/v1/admin/access`	`getAdminAccess`	Check dashboard admin access	`sessionCookie`	Checks current operator authorization using a live browser session; does not grant Agent access.
`DELETE`	`/v1/admin/agent-access`	`revokeAgentAccess`	Remove an Agent tester email	`sessionCookie`	Removes Agent access on subsequent requests; requires an explicit operator action and trusted Origin.
`GET`	`/v1/admin/agent-access`	`listAgentAccess`	List approved Agent tester emails	`sessionCookie`	Exposes tester email addresses; restrict to authorized operators.
`POST`	`/v1/admin/agent-access`	`grantAgentAccess`	Grant Agent testing access to an email	`sessionCookie`	Grants Agent testing access only; requires an authorized browser session and trusted Origin.
`GET`	`/v1/admin/credits`	`getAdminCreditAccount`	Look up an account’s credit balance and recent dashboard grants	`sessionCookie`	Returns cross-account identity, balance and dashboard grant history. Requires a live verified admin browser session; never cache responses.
`POST`	`/v1/admin/credits/grants`	`grantAdminCredits`	Add credits to a user account	`sessionCookie`	Adds spendable credits. Requires a live verified admin browser session and trusted Origin. Retain the request ID and payload for retries; the ledger records the authenticated admin.
`GET`	`/v1/admin/jobs`	`listAdminJobs`	List recent jobs across users	`sessionCookie`	May expose cross-account operational metadata; restrict it to authorized operators.
`GET`	`/v1/admin/proxy-health`	`getAdminProxyHealth`	Read outbound proxy cooldowns	`sessionCookie`	Shows proxy hosts and ports, never credentials; restrict it to authorized operators.
`GET`	`/v1/admin/users`	`searchAdminUsers`	Find active and deleted users by ID or email	`sessionCookie`	Searches cross-account user identities. Requires a live verified admin browser session; never cache responses.
`DELETE`	`/v1/admin/users/{userId}`	`deleteAdminUser`	Delete another user account	`sessionCookie`	Deletes another account through shared Polar and private-data cleanup. Requires live admin authentication, trusted Origin and matching email; cancellation remains mandatory.