Documentation

API documentation

This reference documents endpoints that exist in the running application. It intentionally does not list planned endpoints, and it does not publish administrative or customer-scoped endpoints as if they were public. Base URL: the origin you are reading this on (for production,https://abhibhideveloper.tech).

Authentication

There is no public API-key programme today. Two authentication models exist in the running system:

Session authentication (customer and admin routes). Authenticated endpoints use the platform's session cookie established by the sign-in flow. Requests without a valid session are rejected with 401; requests from an authenticated account without the required role or resource permission are rejected with 403. Ownership is always derived on the server from the session — a client-supplied customer identifier is never accepted as proof of ownership.
Machine identities (agent gateway). The agent-gateway surface authenticates machine connections with issued credentials. Every capability call is authorized server-side against the connection's permissions and requires approval where the capability is classified as high-risk. This surface is internal and is not documented here as a public API.

Never embed credentials, secrets, or API keys in frontend code or public repositories. Provider secrets used by this platform remain server-side and are never returned by any endpoint.

Public endpoints

These endpoints do not require a session. They return published catalog and aggregate data only.

GET/api/productsPublic

Lists published products from the marketplace catalog. Supports text search, category and type filtering, and pagination. Returns product summaries (name, slug, type, category, tags, starting price from the lowest tier) — never internal or unpublished records.

Parameter	Description
q	Text search across product name and tags
category	Filter by product category
type	Filter by product type (for example SAAS, AI_AGENT, AUTOMATION, API)
page / limit	Pagination; limit is capped by the server

curl "https://abhibhideveloper.tech/api/products?q=automation&page=1&limit=10"

Example response (shape)

{ "products": [ { "id": "...", "slug": "...", "name": "...", "type": "SAAS", "category": "...", "startingPrice": 1999 } ], "total": 12, "page": 1 }

GET/api/searchPublic

Cross-catalog search used by the site search. Returns matching published products and services for the supplied query.

Parameter	Description
q	Search term

curl "https://abhibhideveloper.tech/api/search?q=chatbot"

GET/api/platform-statsPublic

Aggregate platform counters used for display (for example number of published products). Counts are derived from the live database; this endpoint does not expose customer data.

curl "https://abhibhideveloper.tech/api/platform-stats"

AI endpoints

POST/api/ai/chatPublic (may require sign-in in some deployments)

Conversational endpoint used by the AI assistant experience. The response is streamed as plain-text chunks. If the server has no configured model provider key, the endpoint returns 503 with a clear 'not configured' message rather than pretending to answer. When a sessionId is supplied, the conversation is stored in the platform's Redis instance for that session; sessions without a sessionId are not persisted by this endpoint.

Parameter	Description
messages	Array of chat messages: [{ role: 'user' \| 'assistant', content: string }]
sessionId	Optional session identifier enabling per-session conversation storage in Redis

curl -X POST https://abhibhideveloper.tech/api/ai/chat \
  -H "Content-Type: application/json" \
  -d '{"messages":[{"role":"user","content":"What is a workflow automation agent?"}]}'

AI output can be inaccurate or incomplete and is not guaranteed. Do not rely on it for financial, legal, medical, employment, or security decisions. Malformed requests are rejected with 400; the endpoint is subject to the platform-wide rate limiter.

Forms

POST/api/enquiriesPublic

Server-validated website enquiry intake used by the contact, enterprise, affiliate and press pages. Stores a lead record with a server-derived source label; the submitted category chooses the routing label. Includes a honeypot field, length limits, and a per-address throttle. No CRM data is returned to the caller.

Parameter	Description
name, email	Required
organization	Optional
category	One of the published enquiry categories
message	10–4000 characters
website	Honeypot — must be empty

curl -X POST https://abhibhideveloper.tech/api/enquiries \
  -H "Content-Type: application/json" \
  -d '{"name":"A","email":"a@example.com","category":"product-pricing","message":"Question about plan limits."}'

Example response (shape)

{ "ok": true }

Authenticated endpoints (not public)

The application also exposes session-authenticated endpoints for customer and administrative functionality — for example dashboard data, cart and checkout, payments and invoices, subscriptions and entitlements, support tickets, and administrative operations. These are server-enforced and scoped to the authenticated account or role. They are intentionally not documented here as a public integration surface, and their exact request bodies may change as the product evolves. If you need an integration, use the enquiry form and describe your requirement.

Errors

Error responses use JSON with a human-readable message and an appropriate HTTP status. Internal details, stack traces, and secrets are never returned.

Status	Meaning
400	Invalid input — missing or malformed fields
401	Authentication required
403	Authenticated but not permitted for this resource or action
404	Resource not found (or not owned by the caller)
429	Rate limit exceeded — retry later
503	Required server configuration unavailable (for example the AI provider key)
500	Unexpected server error — safe message only

Rate limits & versioning

A platform-wide rate limiter is enforced at the edge for API traffic, and public forms and the AI endpoint apply additional throttling. Exact limits depend on the deployment configuration and are not published quantitatively here. There is no separately versioned public API today; endpoint paths may evolve while the platform is early-stage.

Webhooks

The platform receives webhooks from payment and subscription providers. These endpoints are provider-facing, not a public integration surface: requests are verified against the provider's signature over the exact raw request body before anything is processed, and duplicate deliveries are handled idempotently. Webhook secrets remain server-side. The platform does not offer outbound customer webhooks today.

Testing & support

All public examples above use GET or idempotent, non-destructive requests. Never run examples against production with credentials you do not own. For integration questions, describe your use case through the contact form (category: custom software / AI automation) or check the FAQ.