HTTP API reference

Health

Liveness for load balancers; no auth.

• GET/api/healthSee handler

  JSON ok, service name, and uptime seconds.

• HEAD/api/healthSee handler

  Same as GET without body.

Incidents

• GET/api/incidents/{id}/exportSession cookie

  Download incident as Markdown (authenticated Supabase user).

• GET/api/incidents/{id}/evidenceSession cookie

  Download incident evidence pack JSON (timeline, dry-run, audit-linked events).

• GET/api/incidents/{id}/reviewSession cookie

  Download post-incident review Markdown (narrative, timeline, execution evidence, audit snapshot).

• POST/api/incidents/{id}/rca/runSession cookie

  Generate and persist an incident RCA hypothesis with confidence and evidence references.

• GET/api/incidents/{id}/rca/latestSession cookie

  Fetch latest persisted RCA run for an incident.

• GET/api/services/{id}/sloSession cookie

  Fetch service SLO profile plus latest error budget windows (7d/30d).

• GET/api/overview/error-budget-summarySession cookie

  Fetch SLO error budget overview across services (critical/warning burn and average used budget).

Integrations

• POST/api/integrations/alertsBearer ingest token

  Create or dedupe incident from monitoring (Bearer alert ingest token). Paid-gated per deployment; validates token server-side. Supports normalized Smohix payload, Datadog, Prometheus/Grafana Alertmanager, PagerDuty, and New Relic payloads (vendor-specific dedupe keys). Optional HMAC signature check via SMOHIX_ALERT_WEBHOOK_SIGNING_SECRET.

• POST/api/integrations/vulnerabilitiesBearer ingest token

  Upsert Qualys/Tenable finding; auto-open incident for high/critical (Bearer ingest token). Same token as alert ingest. Optional X-Smohix-Vuln-Source header. Supports Qualys (QID/HOST), Tenable (plugin/asset), or generic finding_id payloads.

• GET/api/health/dbNone

  Postgres readiness via database health RPC (requires migration #15).

• GET/api/connectors/statusSession cookie when Supabase auth is enabled

  Probe configured reasoning/automation connector URLs.

• GET/api/integrations/connectionsSession cookie

  List org-scoped first-party integration connection records.

• POST/api/integrations/connectionsSession cookie (owner/admin/operator)

  Create an org-scoped integration connection placeholder for Slack, PagerDuty, Jira, ServiceNow, GitHub, Datadog, or Prometheus.

• POST/api/integrations/deploy-eventsSession cookie

  Ingest an authenticated deploy/change event for incident and Copilot correlation.

• POST/api/integrations/slack/approvalsSlack request signature (X-Slack-Signature)

  Receive signed Slack action payloads and decide pending approvals.

• POST/api/approvals/policy-suggestions/promoteSession cookie (or session mode fallback)

  Promote a decision-intelligence policy suggestion into policy review and log audit evidence.

• GET/api/deployment/profileSession cookie

  Active organization deployment tier, data region, and boundary (FedRAMP-oriented).

• GET/api/deployment/retentionSession cookie

  Effective org retention policy for audit_log and closed incidents (tier defaults + overrides).

• GET/api/governance/compliance/summarySession cookie

  SOC 2 / ISO 27001 control coverage from audit_log and accepted policies (30d window).

• GET/api/governance/compliance/programSession cookie

  Compliance program dashboard — weighted readiness, SOC 2 / ISO gaps, attestation and vendor rollups.

• GET/api/governance/compliance/gap-remediationsSession cookie

  Gap-to-runbook remediation queue from live assessment exceptions plus org tracking rows.

• GET/api/governance/compliance/risk-heatmapSession cookie

  Compliance risk heatmap — framework concentration, vendor tier matrix, and top hotspots from live org data.

• GET/api/governance/compliance/executive-summarySession cookie

  Board-ready GRC executive summary — program readiness, frameworks, hotspots, and leadership actions (JSON, Markdown, HTML, CSV).

• GET/api/governance/compliance/calendarSession cookie

  GRC compliance calendar — attestations, vendor reviews, bundles, audit season checkpoints (JSON or CSV).

• GET/api/governance/compliance/benchmarkingSession cookie

  Control benchmarking — org readiness percentiles vs industry reference cohorts (JSON or CSV).

• GET/api/governance/compliance/policy-driftSession cookie

  Policy drift — accepted automation guardrails vs live assessment gaps (JSON or CSV).

• GET/api/governance/compliance/control-graphSession cookie

  Control dependency graph — crosswalk, thematic, shared audit, and shared policy edges (JSON or CSV).

• GET/api/governance/compliance/regulatory-impactSession cookie

  Regulatory change impact — scenario readiness deltas vs live baseline (JSON or CSV).

• GET/api/governance/compliance/evidence-lineageSession cookie

  Evidence lineage — audit and policy sources through bundles to assessor workbook (JSON or CSV).

• GET/api/governance/compliance/testing-evidence-linkerSession cookie

  Control testing evidence linker — dry-run outputs mapped to controls and evidence bundles (JSON or CSV).

• POST/api/governance/compliance/testing-evidence-linkerSession cookie

  Record test-to-bundle links in audit log for assessor export trail.

• GET/api/governance/compliance/testing-schedulesSession cookie

  Control testing schedules — recurring evidence windows from attestations, checkpoints, and freshness (JSON or CSV).

• GET/api/governance/compliance/scope-boundarySession cookie

  Scope boundary mapper — in-scope systems, data flows, and framework control mappings (JSON or CSV).

• GET/api/governance/compliance/kpi-trendsSession cookie

  Compliance KPI trends — weekly remediation velocity, attestation closure, framework readiness (JSON or CSV).

• GET/api/governance/compliance/posture-scoreSession cookie

  Unified compliance posture score — blended readiness, attestations, vendors, gaps, risk (JSON or CSV).

• GET/api/governance/compliance/control-ownershipSession cookie

  GRC control ownership matrix — RACI per control linked to scope and attestations (JSON or CSV).

• GET/api/governance/compliance/exception-registerSession cookie

  Compliance exception register — assessment gaps, policy drift, compensating remediations (JSON or CSV).

• GET/api/governance/compliance/evidence-requestsSession cookie

  Assessor evidence request workflow — open document requests with due dates and control linkage (JSON or CSV).

• GET/api/governance/compliance/evidence-request-slaSession cookie

  Evidence request SLA dashboard — overdue queue, at-risk window, fulfillment metrics (JSON or CSV).

• POST/api/governance/compliance/evidence-request-slaSession cookie

  Deliver auditor evidence request SLA digest (email + optional webhook).

• POST/api/governance/compliance/evidence-request-sla/scheduledBearer cron secret

  Cron SLA digest delivery (Bearer SMOHIX_EVIDENCE_REQUEST_SLA_CRON_SECRET).

• GET/api/governance/compliance/obligation-icsSession cookie

  Compliance obligation ICS — iCalendar feed of attestations, vendors, bundles, checkpoints (text/calendar).

• GET/api/governance/compliance/mapping-digestSession cookie

  Preview regulatory mapping change digest vs last org snapshot.

• POST/api/governance/compliance/mapping-digestSession cookie

  Run mapping change digest — webhook/email when catalog or crosswalk changes.

• POST/api/governance/compliance/mapping-digest/scheduledBearer cron secret

  Cron mapping digest (Bearer SMOHIX_MAPPING_DIGEST_CRON_SECRET).

• GET/api/governance/compliance/inherited-control-gapsSession cookie

  Inherited control coverage gaps — vendors missing evidence on tier-inherited controls (JSON or CSV).

• GET/api/governance/compliance/control-health-scorecardSession cookie

  Leadership control health scorecard — posture, vendor inherited controls, and gap closure (JSON or CSV).

• GET/api/governance/compliance/obligation-heatmapSession cookie

  Regulatory obligation heatmap — open obligations by framework, vendor tier, and testing schedule (JSON or CSV).

• GET/api/governance/compliance/obligation-crossoverSession cookie

  Multi-framework obligation crossover — shared due windows and crosswalk-linked evidence reuse clusters (JSON or CSV).

• GET/api/governance/compliance/obligation-consolidationSession cookie

  Obligation consolidation playbook — six-step workflows per crossover cluster with tracked play status (JSON or CSV).

• GET/api/governance/compliance/obligation-forecastSession cookie

  Board obligation forecast — weekly forward-looking obligation density and committee milestones (JSON or CSV).

• GET/api/governance/compliance/obligation-whatifSession cookie

  Board obligation what-if — stress-test forecast density with week shifts or framework descope (JSON or CSV).

• GET/api/governance/compliance/committee-capacity-budgetSession cookie

  Committee obligation capacity budget — weekly owner-hours vs forecast peaks with shortfall flags (JSON or CSV).

• GET/api/governance/compliance/obligation-load-balancingSession cookie

  Obligation owner load balancing — peak-week RACI load slices and rebalance suggestions (JSON or CSV).

• GET/api/governance/compliance/peak-week-staffing-digestSession cookie

  Peak-week staffing digest — capacity shortfall + load imbalance coincidence preview (JSON or CSV).

• POST/api/governance/compliance/peak-week-staffing-digestSession cookie (owner/admin)

  Deliver peak-week staffing digest (email, Slack, optional webhook).

• POST/api/governance/compliance/peak-week-staffing-digest/scheduledBearer cron secret

  Cron peak-week staffing digest (Bearer SMOHIX_PEAK_WEEK_STAFFING_DIGEST_CRON_SECRET).

• GET/api/governance/compliance/staffing-actionsSession cookie

  Obligation staffing action tracker — proposed and tracked load-balance and capacity relief actions (JSON, CSV, or HTML completion report).

• GET/api/governance/compliance/staffing-action-remindersSession cookie

  Staffing action overdue reminders — open actions past peak week preview (JSON or CSV).

• POST/api/governance/compliance/staffing-action-remindersSession cookie (owner/admin)

  Send staffing action overdue reminders (email and Slack).

• POST/api/governance/compliance/staffing-action-reminders/scheduledBearer cron secret

  Cron staffing overdue reminders (Bearer SMOHIX_STAFFING_OVERDUE_REMINDER_CRON_SECRET).

• GET/api/governance/compliance/staffing-completion-rollupSession cookie

  Staffing completion rollup — tracked vs open vs completed archive (JSON, CSV, or printable HTML).

• POST/api/governance/compliance/staffing-completion-rollupSession cookie (owner/admin)

  Email weekly staffing completion rollup to owners and admins.

• POST/api/governance/compliance/staffing-completion-rollup/scheduledBearer cron secret

  Cron staffing completion rollup (Bearer SMOHIX_STAFFING_COMPLETION_ROLLUP_CRON_SECRET).

• GET/api/governance/compliance/staffing-sla-breach-digestSession cookie

  Staffing SLA breach digest — open actions past committee completion SLA after peak week (JSON or CSV).

• POST/api/governance/compliance/staffing-sla-breach-digestSession cookie (owner/admin)

  Deliver staffing SLA breach digest (email and Slack).

• POST/api/governance/compliance/staffing-sla-breach-digest/scheduledBearer cron secret

  Cron staffing SLA breach digest (Bearer SMOHIX_STAFFING_SLA_BREACH_DIGEST_CRON_SECRET).

• GET/api/governance/compliance/cross-staffing-committee-escalationSession cookie

  Cross-staffing committee escalation — SLA breaches still open after completion rollup email (JSON or CSV).

• POST/api/governance/compliance/cross-staffing-committee-escalationSession cookie (owner/admin)

  Deliver cross-staffing committee escalation (email and Slack).

• POST/api/governance/compliance/cross-staffing-committee-escalation/scheduledBearer cron secret

  Cron cross-staffing committee escalation (Bearer SMOHIX_CROSS_STAFFING_COMMITTEE_ESCALATION_CRON_SECRET).

• POST/api/governance/compliance/staffing-digest-auto-chain/scheduledBearer cron secret

  Cron staffing digest auto-chain — rollup, SLA digest, escalation in one run (Bearer SMOHIX_STAFFING_DIGEST_AUTO_CHAIN_CRON_SECRET).

• GET/api/governance/compliance/committee-digestSession cookie

  Quarterly obligation committee digest — forecast, crossover, and SLA rollup preview (JSON or CSV).

• POST/api/governance/compliance/committee-digestSession cookie (owner/admin)

  Deliver quarterly obligation committee digest (email + optional webhook).

• POST/api/governance/compliance/committee-digest/scheduledBearer cron secret

  Cron quarterly digest delivery (Bearer SMOHIX_OBLIGATION_COMMITTEE_DIGEST_CRON_SECRET).

• GET/api/governance/compliance/obligation-rollupSession cookie

  Obligation executive rollup — printable HTML (print to PDF), JSON, or CSV for board packets.

• GET/api/governance/compliance/obligation-density-alertsSession cookie

  Obligation density alerting — forecast breach preview against org thresholds (JSON or CSV).

• POST/api/governance/compliance/obligation-density-alertsSession cookie (owner/admin)

  Send obligation density Slack and email alerts for active breaches.

• POST/api/governance/compliance/obligation-density-alerts/scheduledBearer cron secret

  Cron obligation density alerts (Bearer SMOHIX_OBLIGATION_DENSITY_ALERT_CRON_SECRET).

• GET/api/governance/compliance/obligation-density-trend-historySession cookie

  Obligation density trend history — trailing-quarter weekly density and alert deliveries (JSON or CSV).

• GET/api/governance/compliance/committee-meeting-packSession cookie

  Committee meeting pack ZIP — printable HTML summary, scorecard, posture, exceptions, and open gaps.

• GET/api/governance/compliance/attestation-renewalSession cookie

  Attestation renewal calendar — renewal waves by due window with framework rollup (JSON or CSV).

• POST/api/governance/compliance/attestation-renewalSession cookie

  Email control owners for current renewal waves (org admins).

• POST/api/governance/compliance/attestation-renewal/scheduledBearer cron secret

  Cron owner renewal nudges (Bearer SMOHIX_ATTESTATION_RENEWAL_CRON_SECRET).

• GET/api/governance/legal-holdsSession cookie

  Active legal holds on incidents and count of audit rows flagged (org-scoped).

• GET/api/governance/compliance/bundlesSession cookie

  List persisted assessor evidence bundles for the active organization.

• POST/api/governance/compliance/bundlesSession cookie (owner/admin)

  Create tamper-evident evidence bundle; optional webhook delivery to org URL.

• POST/api/governance/compliance/bundles/scheduledBearer cron secret

  Cron entrypoint to generate bundle (Bearer SMOHIX_BUNDLE_CRON_SECRET, body: orgId, window).

• GET/api/governance/compliance/bundles/{id}Session cookie

  Fetch persisted evidence bundle metadata and manifest verification for the active org.

• GET/api/governance/compliance/bundles/{id}/downloadSession cookie

  Download evidence bundle ZIP archive by bundle id.

• GET/api/governance/compliance/crosswalkSession cookie

  SOC 2 / ISO 27001 crosswalk — mapping matrix with optional periodDays and format=csv|json; evidence overlay per control.

• GET/api/governance/compliance/workbookSession cookie

  Unified assessor workbook ZIP — evidence pack, crosswalk, framework assessments, README, and tamper-evident manifest.

• POST/api/governance/compliance/digestSession cookie (owner/admin)

  Compliance program digest — readiness deltas vs prior snapshot, overdue attestations; optional HTTPS webhook delivery.

• POST/api/governance/compliance/digest/scheduledBearer SMOHIX_DIGEST_CRON_SECRET

  Cron digest delivery — Bearer SMOHIX_DIGEST_CRON_SECRET; body { orgId, periodDays? }.

• GET/api/governance/compliance/sla-remindersSession cookie

  Preview SLA reminder candidates (due soon, overdue, regressed) and org settings.

• POST/api/governance/compliance/sla-remindersSession cookie (owner/admin)

  Send compliance SLA reminders via Slack and optional Resend email (owner/admin).

• POST/api/governance/compliance/sla-reminders/scheduledBearer SMOHIX_SLA_CRON_SECRET

  Cron SLA reminders — Bearer SMOHIX_SLA_CRON_SECRET; body { orgId }.

• GET/api/governance/compliance/fedramp-poamSession cookie

  FedRAMP POA&M export — NIST 800-53 rows from continuous assessment gaps; periodDays and format=csv|json.

• GET/api/governance/compliance/evidence-freshnessSession cookie

  Evidence freshness dashboard — per-control last evidence timestamps, stale queue; format=csv|json.

• GET/api/governance/compliance/baseline-comparisonSession cookie

  Multi-framework baseline comparison — live readiness and prior-period deltas for all framework packs; format=csv|json.

• GET/api/governance/compliance/assessor-tokensSession cookie

  List org assessor API tokens and allowed export resource paths.

• POST/api/governance/compliance/assessor-tokensSession cookie (owner/admin)

  Create org assessor API token (smohix_ca_*); returns plaintext key once.

• DELETE/api/governance/compliance/assessor-tokens/{id}Session cookie (owner/admin)

  Revoke assessor API token.

• GET/api/governance/compliance/assessor/{id}Bearer assessor token

  Assessor read-only export — evidence-export, workbook, crosswalk, obligation-ics, baseline-comparison, risk-heatmap, executive-summary, framework reports; Bearer smohix_ca_* token.

• GET/api/governance/compliance/exportSession cookie

  Compliance evidence pack — audit events + accepted policies with control tags (CSV or JSON).

• GET/api/governance/compliance/type-iiSession cookie

  SOC 2 Type II continuous monitoring report — control trends, exceptions, evidence bundle and legal-hold counts.

• GET/api/governance/compliance/iso-assessmentSession cookie

  ISO 27001 Annex A continuous assessment — domain readiness, control trends, and gap analysis.

• GET/api/governance/compliance/pci-dssSession cookie

  PCI DSS v4 control pack — requirement readiness, trends, and gap analysis from shared audit evidence.

• GET/api/governance/compliance/hipaaSession cookie

  HIPAA Security Rule safeguards — readiness, trends, gap analysis, and BAA vendor control inheritance.

• GET/api/governance/compliance/nist-csfSession cookie

  NIST CSF 2.0 alignment — function maturity tiers, control trends, and gap analysis from shared audit evidence.

• GET/api/governance/compliance/cis-v8Session cookie

  CIS Controls v8 safeguard pack — Implementation Group readiness, control trends, and gap analysis.

• GET/api/governance/compliance/cmmc-l2Session cookie

  CMMC 2.0 Level 2 overlay — 800-171 practice readiness, SPRS-style score, and gap analysis.

• GET/api/governance/compliance/gdpr-art32Session cookie

  GDPR Article 32 technical measures — domain readiness, DPA bands, and gap analysis.

• GET/api/governance/compliance/attestationsSession cookie

  Control attestation board — owners, due dates, status, linked audit evidence counts per SOC 2 / ISO control.

• GET/api/governance/third-party/vendorsSession cookie

  Third-party risk register — vendors with inherited controls, attestation status, and reused audit evidence counts.

• POST/api/governance/third-party/vendorsSession cookie (owner/admin)

  Add vendor; inherit SOC 2 / ISO controls from risk tier and category (owner/admin).

• GET/api/governance/policy-blocks/summarySession cookie

  Return policy-block analytics summary for current user (window=7d|30d, includes prior-window delta and reason distribution).

Automations

• POST/api/automations/dry-runSession cookie

  Run playbook dry-run; may persist and append audit when configured.

• POST/api/automations/executeSession cookie

  Record guarded execution after successful dry-run with approval note and rollback plan.

• POST/api/automations/remediateSession cookie

  Run guarded remediation with dry-run freshness and accepted policy checks.

• GET/api/automations/policiesSession cookie

  List versioned automation policy-as-code documents for the active workspace.

• POST/api/automations/policiesSession cookie (owner/admin/operator)

  Create a draft or active policy-as-code version for a playbook.

• GET/api/attack-paths/simulateSession cookie

  Simulate ranked attack paths from vuln entry points through dependency graph to production targets. Optional query: targetServiceId, maxDepth.

• GET/api/services/dependency-graphSession cookie

  Fetch service dependency graph (nodes and directed edges).

Copilot

• POST/api/copilot/chatSession cookie when OPENAI_API_KEY and Supabase auth are set; otherwise IP rate limit

  Streaming or JSON chat completion (OpenAI → reasoning URL → guided offline).

• GET/api/copilot/threadsSession cookie

  List conversation threads.

• POST/api/copilot/threadsSession cookie

  Create thread.

• GET/api/copilot/threads/{id}/messagesSession cookie

  List messages in a thread.

• POST/api/copilot/threads/{id}/messagesSession cookie

  Append user message and run assistant turn.

User-scoped keys

• GET/api/user/api-keysSession cookie

  List API keys (metadata).

• POST/api/user/api-keysSession cookie

  Create API key (returns plaintext once).

• DELETE/api/user/api-keys/{id}Session cookie

  Revoke key.

• GET/api/user/alert-ingest-tokensSession cookie

  List alert ingest tokens.

• POST/api/user/alert-ingest-tokensSession cookie

  Create ingest token (returns secret once).

• DELETE/api/user/alert-ingest-tokens/{id}Session cookie

  Revoke ingest token.

• GET/api/user/exportSession cookie

  Download JSON export of user incidents and profile metadata.

• GET/api/user/notification-preferencesSession cookie

  Read notification preference flags.

• PUT/api/user/notification-preferencesSession cookie

  Update notification preference flags on profile.

• POST/api/user/account/delete-requestSession cookie

  Submit account deletion request for manual review.

Connector proxies

Forward to REACT_APP_SH_BACKEND_API and REACT_APP_ROBOT_BACKEND when set.

• GET|POST|PUT|PATCH|DELETE/api/reasoning/*Session cookie or Smohix API key (Bearer smohix_sk_… / X-Smohix-Api-Key)

  Proxy to reasoning backend.

• GET|POST|PUT|PATCH|DELETE/api/robot/*Session cookie or Smohix API key (Bearer smohix_sk_… / X-Smohix-Api-Key)

  Proxy to automation robot backend.

Audit

• GET/api/audit/exportSession cookie

  Download all audit_log rows for the signed-in user as CSV (optional window=24h|7d|30d|all).

• GET/api/audit/slack-events/exportSession cookie

  Download Slack delivery audit rows as CSV (optional window=24h|7d|30d|all).

Marketing & leads

Public contact intake and platform-admin lead review on smohix.run.

• POST/api/contactNone (public form)

  Submit a contact or pilot enquiry (validated, rate-limited, stored via service role). Returns referenceId (ZEN-XXXXXX). Honeypot, consent, and minimum submit duration enforced. No PII in logs.

• GET/api/admin/leadsSession cookie + SMOHIX_PLATFORM_ADMIN_EMAILS

  List contact leads with pagination and filters (platform admin email allowlist).

• PATCH/api/admin/leadsSession cookie + SMOHIX_PLATFORM_ADMIN_EMAILS

  Update lead status, internal notes, or assignment.

• GET/api/admin/leads/{id}Session cookie + SMOHIX_PLATFORM_ADMIN_EMAILS

  Lead detail with append-only activity history.

• PATCH/api/admin/leads/{id}Session cookie + SMOHIX_PLATFORM_ADMIN_EMAILS

  Update lead pipeline fields (stage, owner, follow-up, priority).

• POST/api/admin/leads/{id}/convert-pilotSession cookie + SMOHIX_PLATFORM_ADMIN_EMAILS

  Create pilot project from lead (admin action only).

• POST/api/admin/leads/{id}/emailSession cookie + SMOHIX_PLATFORM_ADMIN_EMAILS

  Prepare or send follow-up email template (Resend if configured).

• GET/api/admin/leads/exportSession cookie + SMOHIX_PLATFORM_ADMIN_EMAILS

  CSV export of filtered leads (formula-safe).

• GET/api/admin/dashboardSession cookie + SMOHIX_PLATFORM_ADMIN_EMAILS

  RevOps dashboard metrics from live lead/pilot data.

• GET/api/admin/pilotsSession cookie + SMOHIX_PLATFORM_ADMIN_EMAILS

  List pilot projects.

• POST/api/admin/pilotsSession cookie + SMOHIX_PLATFORM_ADMIN_EMAILS

  Create pilot from lead ID.

• GET/api/admin/pilots/{id}Session cookie + SMOHIX_PLATFORM_ADMIN_EMAILS

  Pilot detail with activity history.

• PATCH/api/admin/pilots/{id}Session cookie + SMOHIX_PLATFORM_ADMIN_EMAILS

  Update pilot fields and status.

• GET/api/admin/pilots/{id}/proposalSession cookie + SMOHIX_PLATFORM_ADMIN_EMAILS

  Deterministic pilot proposal (JSON, HTML, or Markdown).

• GET/api/admin/pilots/{id}/calendarSession cookie + SMOHIX_PLATFORM_ADMIN_EMAILS

  Download .ics for discovery, kickoff, or review dates.

• GET/api/admin/pilots/exportSession cookie + SMOHIX_PLATFORM_ADMIN_EMAILS

  CSV export of pilot projects.

Billing

• GET/api/billing/checkoutSession cookie

  Redirect signed-in user to PayPal approval URL for tier (pro|team|top_up).

• POST/api/billing/checkoutSession cookie

  Create PayPal subscription or top-up order; returns approvalUrl.

• POST/api/webhooks/paypalPayPal webhook signature

  PayPal billing webhook (subscriptions, top-ups, cancellations).

• POST/api/webhooks/lemonsqueezyWebhook signature (Lemon)

  Lemon Squeezy subscription webhook (legacy).