API Overview

The Fastify service defaults to http://localhost:3001. REST endpoints return JSON with errors shaped as { "error": { "code", "message" } }. Validation errors also include field-level details.

Health and identity

GET    /health
GET    /api/me
GET    /api/organizations/current
GET    /api/members
POST   /api/organizations
GET    /api/dashboard

Repositories and tokens

GET    /api/repositories
POST   /api/repositories
PATCH  /api/repositories/:id
DELETE /api/repositories/:id
GET    /api/tokens
POST   /api/tokens
DELETE /api/tokens/:id

Token plaintext is returned only by POST /api/tokens. List responses contain metadata and the safe prefix only.

POST /api/repositories accepts full_name as either owner/repository or a full HTTPS GitHub repository URL and normalizes it to owner/repository. Non-GitHub and nested GitHub URLs are rejected with field-level validation details.

Memories

GET    /api/memories
POST   /api/memories
GET    /api/memories/:id
PATCH  /api/memories/:id
POST   /api/memories/:id/publish
POST   /api/memories/:id/dispute
POST   /api/memories/:id/archive
POST   /api/memories/:id/reports
POST   /api/memories/:id/reports/:reportId/resolve
POST   /api/context/search
POST   /api/context/get

GET /api/memories supports stable cursor pagination plus query, repository, type, status, and confidence filters.

Personal memory

GET    /api/personal-memories
GET    /api/personal-memories/stats
GET    /api/personal-memories/:id
POST   /api/personal-memories/import

These endpoints are scoped to the authenticated user, not the current organisation. POST /api/personal-memories/import upserts one source document by source_kind and source_key; the server computes its content checksum. The list endpoint supports cursor pagination plus query and source_kind filters and returns a short content preview. The stats endpoint returns totals by source and by the first folder in each source key so the dashboard can show an honest collection distribution without inferring semantic relationships. Personal memory never participates in the team context endpoints or MCP retrieval.

MCP

POST /mcp implements Streamable HTTP and requires Authorization: Bearer itk_.... It exposes exactly:

• get_context
• search_context
• propose_memory
• publish_memory
• report_stale

Missing, invalid, expired, and revoked tokens return 401. Unknown cross-tenant objects return the same 404 as absent objects. Validation errors and tool failures never include server stack traces.