API Reference

Arboris does not offer a public programmatic API in alpha. The authenticated /api/v1 API exists to support the first-party customer app.

This reference explains the current boundary so customers know what is and is not supported.

Alpha API Boundary

Question	Current answer
Is there a public API key flow?	No.
Are bearer tokens supported for customer integrations?	No.
Are endpoints versioned?	Yes, first-party app endpoints live under /api/v1.
Is OpenAPI used internally?	Yes, for generated first-party TypeScript contracts.
Can customers build external integrations on this API?	Not in alpha.

Programmatic API access is explicitly outside alpha scope.

Authentication Model

The first-party app uses host-scoped httpOnly cookies for customer app requests.

Do not build automation that depends on browser cookies or private first-party routes. Those routes can change as the app evolves.

Common Response Patterns

Paginated list endpoints use a data envelope with total count and page metadata.

{
  "data": [],
  "total": 150,
  "page": 1,
  "page_size": 25
}

Error responses use a stable error envelope.

{
  "error": {
    "code": "SYNC_002",
    "message": "Unable to reach QuickBooks. Please try again later."
  }
}

Error code categories include auth, firm, client, sync, AI, billing, report, and general errors.

First-Party Route Families

The customer app uses route families for:

• Auth.
• Command Center.
• Billing.
• Clients.
• Analysis.
• AI Chat.
• Integrations.
• Reports.
• Review Runs.
• Search.
• Settings.

Supported Integrations

QuickBooks is the only functional accounting integration in alpha.

Xero and CSV import do not have alpha connect or sync endpoints. They are represented in the provider picker as Coming Soon cards only.

Health Endpoints

Use the health reference for public health behavior. For app availability checks, prefer the versioned backend health endpoint at /api/v1/health.