================================================================================
API DOCUMENTATION
Generated: 2026-09-04T16:38:02.943Z
================================================================================

BASE URL: http://is-your-app-safe.overskill.app

AUTHENTICATION
--------------
Bearer token required in Authorization header:
Authorization: Bearer <your-oauth-token>

Get token via OAuth flow at: http://is-your-app-safe.overskill.app/auth

CORE ENDPOINTS
--------------

Authentication:
GET    /api/auth/me         - Get current user info
POST   /api/auth/logout     - Logout current session
POST   /api/auth/refresh    - Refresh access token

Entities:

Scans:
POST   /api/entities/scans      - Create new scans

Leads:
POST   /api/entities/leads      - Create new leads

ScanLeads:
POST   /api/entities/scanLeads      - Create new scanLeads

Custom Endpoints:

POST   /api/scan [Public]
  Public anonymous scanner: fingerprints the target stack, scrapes/renders the page, runs an AI security+quality audit, persists a scan, and returns platform, confidence, teaser findings (first 3) and locked_count. Same-zone OverSkill-hosted targets are acquired via platform-origin scrape (www.overskill.com, a different CF zone) → browserRender → app-origin scrape (Cloudflare blocks same-zone Worker subrequests). CF/CDN edge/transport errors are treated as honest scan failures, never as findings.
POST   /api/unlock [Public]
  Public anonymous unlock: validates email + scan_id, provisions a REAL OverSkill early-access invite server-side (never fabricates codes), persists a scanLead, emails the full report (boost-aware copy when no code), and returns full_findings, invite_code, redeem_url, skip_line and queue_boosted.

INTEGRATIONS
------------
GET    /api/composio/connections   - List Composio connections
POST   /api/composio/execute       - Execute Composio action
  Body: { action, params, provider, alias? }. `alias` names ONE of
  the signed-in user's own connected accounts for that provider
  (e.g. "Work Gmail"); omit it to use their default account.

ANALYTICS
---------
POST   /api/analytics/record       - Record analytics event

BACKGROUND JOBS
---------------
POST   /api/backend/queue-job      - Queue background job
GET    /api/backend/job-status/{id} - Get job status

AI FEATURES
-----------
POST   /api/ai/chat                - AI chat completion
POST   /api/ai/object              - Generate structured JSON (schema-constrained)
POST   /api/ai/vision              - Image/OCR understanding (base64 image -> text/JSON)
POST   /api/ai/embedding           - Generate embeddings

KNOWLEDGE BASE
--------------
POST   /api/rag/upload             - Upload document
POST   /api/rag/query              - Query knowledge base
GET    /api/rag/documents          - List documents
DELETE /api/rag/documents/{id}     - Delete document

--------------------------------------------------------------------------------
For detailed OpenAPI specification: http://is-your-app-safe.overskill.app/api/openapi.json
For interactive docs: http://is-your-app-safe.overskill.app/api-docs