API reference

The Confabulous backend exposes a JSON HTTP API used by the web frontend, the confab CLI, and external integrations. All endpoints are prefixed with /api/v1 unless otherwise noted.

Authentication

Two methods:

API key (Bearer token, used by the CLI) — Authorization: Bearer cfb_....
Session cookie (used by the web UI) — confab_session cookie, set after OAuth or password login. CSRF is enforced via Fetch metadata validation; no token required.

Full authentication reference →

Endpoint groups

CLI endpoints (API key auth)

The bulk of the upload pipeline. Used by the confab CLI to register sessions and stream transcript chunks in real time as sessions progress.

GET /api/v1/auth/validate — validate an API key.
POST /api/v1/sync/init — start or resume a sync session.
POST /api/v1/sync/chunk — upload a transcript chunk.
POST /api/v1/sync/complete — finalize an upload.

Full CLI endpoint reference →

External API endpoints (API key auth)

For programmatic integrations — third-party tools that want to query sessions or analytics.

Full external API reference →

Web endpoints (session auth)

Everything the dashboard talks to: list sessions, fetch session detail, regenerate smart recap, manage shares, trends, TILs.

Full web endpoint reference →

OAuth endpoints

OAuth callback URLs for GitHub, Google, and generic OIDC providers.

Full OAuth reference →

Admin endpoints (super-admin only)

User management, activation, storage monitoring.

Full admin reference →

Public endpoints (no auth)

Shared-session view, health checks, public assets.

Full public reference →

Conventions

Error responses — uniform error envelope.
Rate limits — per-user and per-endpoint.
Request body size limits.
Email domain restrictions — ALLOWED_EMAIL_DOMAINS enforcement.
Read-only identity (Demo Mode) — how mutating requests from the demo user are blocked.