API Reference

Base URL: http://localhost:4000/api

All endpoints (except auth) require Authorization: Bearer <access_token>.

Authentication

Method	Path	Auth	Description
POST	/api/auth/register	No	Create account
POST	/api/auth/login	No	Login
POST	/api/auth/refresh	No	Refresh access token
POST	/api/auth/logout	Yes	Logout
GET	/api/auth/me	Yes	Current user profile
PATCH	/api/auth/me	Yes	Update profile

Users

Method	Path	Auth	Description
GET	/api/users	Yes	List users (up to 20)
GET	/api/users/:id	Yes	Get user details
GET	/api/users/search	Yes	Search users by query

Organizations

Method	Path	Auth	Permissions
GET	/api/organizations	Yes	—
POST	/api/organizations	Yes	—
GET	/api/organizations/:orgId	Yes	org:view
PATCH	/api/organizations/:orgId	Yes	org:edit
DELETE	/api/organizations/:orgId	Yes	org:delete
GET	/api/organizations/:orgId/members	Yes	org:members.view
POST	/api/organizations/:orgId/members	Yes	org:members.invite
PATCH	/api/organizations/:orgId/members/:userId	Yes	org:members.roles
DELETE	/api/organizations/:orgId/members/:userId	Yes	org:members.remove

Teams

Method	Path	Auth	Permissions
GET	/api/teams	Yes	—
POST	/api/teams	Yes	—
GET	/api/teams/:teamId	Yes	team:view
PATCH	/api/teams/:teamId	Yes	team:edit
DELETE	/api/teams/:teamId	Yes	team:delete
GET	/api/teams/:teamId/members	Yes	team:members.view
POST	/api/teams/:teamId/members	Yes	team:members.add
PATCH	/api/teams/:teamId/members/:userId	Yes	team:members.roles
DELETE	/api/teams/:teamId/members/:userId	Yes	team:members.remove
GET	/api/teams/by-slug/:teamSlug/tasks	Yes	task:view

Projects

Method	Path	Auth	Permissions
GET	/api/projects	Yes	—
POST	/api/projects	Yes	project:create
GET	/api/projects/:projectId	Yes	project:view
PATCH	/api/projects/:projectId	Yes	project:edit
DELETE	/api/projects/:projectId	Yes	project:delete
GET	/api/projects/:projectId/members	Yes	project:members.view
POST	/api/projects/:projectId/members	Yes	project:members.add
DELETE	/api/projects/:projectId/members/:userId	Yes	project:members.remove

Tasks

Method	Path	Auth	Permissions
GET	/api/tasks/my	Yes	—
GET	/api/projects/:projectId/tasks	Yes	task:view
POST	/api/projects/:projectId/tasks	Yes	task:create
GET	/api/projects/:projectId/tasks/:taskId	Yes	task:view
PATCH	/api/projects/:projectId/tasks/:taskId	Yes	task:edit
PATCH	/api/projects/:projectId/tasks/:taskId/status	Yes	task:edit
DELETE	/api/projects/:projectId/tasks/:taskId	Yes	task:delete

Task Comments

Method	Path	Auth	Description
GET	/api/projects/:projectId/tasks/:taskId/comments	Yes	List comments
POST	/api/projects/:projectId/tasks/:taskId/comments	Yes	Create comment
PATCH	/api/projects/:projectId/tasks/:taskId/comments/:commentId	Yes	Edit comment
DELETE	/api/projects/:projectId/tasks/:taskId/comments/:commentId	Yes	Delete comment
POST	/api/projects/:projectId/tasks/:taskId/comments/attachments	Yes	Upload attachments

Task History

Method	Path	Auth	Permissions
GET	/api/projects/:projectId/tasks/:taskId/history	Yes	task:view

Chat

Method	Path	Auth	Description
GET	/api/chats/conversations	Yes	List conversations
POST	/api/chats/direct/:userId	Yes	Direct conversation
POST	/api/chats/task/:taskId	Yes	Task conversation
GET	/api/chats/conversations/:convId/messages	Yes	List messages
POST	/api/chats/conversations/:convId/messages	Yes	Send message

Notifications

Method	Path	Auth	Description
GET	/api/notifications	Yes	List notifications
GET	/api/notifications/unread-count	Yes	Unread count
PATCH	/api/notifications/:id/read	Yes	Mark as read
PATCH	/api/notifications/read-all	Yes	Mark all as read
DELETE	/api/notifications/:id	Yes	Delete notification

Admin

Method	Path	Auth	Description
GET	/api/admin/users	Yes	List all users
PATCH	/api/admin/users/:id	Yes	Update user
DELETE	/api/admin/users/:id	Yes	Delete user
GET	/api/admin/organizations	Yes	List all orgs
GET	/api/admin/teams	Yes	List all teams
GET	/api/admin/roles	Yes	List roles
POST	/api/admin/roles	Yes	Create role
PATCH	/api/admin/roles/:id	Yes	Update role
DELETE	/api/admin/roles/:id	Yes	Delete role
GET	/api/admin/groups	Yes	List groups
POST	/api/admin/groups	Yes	Create group
PATCH	/api/admin/groups/:id	Yes	Update group
DELETE	/api/admin/groups/:id	Yes	Delete group

Error Responses

All errors return a consistent JSON structure:

{
  "statusCode": 400,
  "message": "Error description",
  "error": "Bad Request"
}

Common status codes:

• 200 — Success
• 201 — Created
• 400 — Bad Request (validation error)
• 401 — Unauthorized
• 403 — Forbidden
• 404 — Not Found
• 409 — Conflict
• 500 — Internal Server Error

Pagination

List endpoints support pagination via query parameters:

Parameter	Type	Default	Description
page	number	1	Page number
limit	number	20	Items per page

{
  "data": [...],
  "total": 50,
  "page": 1,
  "limit": 20
}