Internal endpoint inventory - video2ctx

These routes are documented for transparency and maintainers. They are intentionally excluded from the interactive API playground.

This page is generated from platform/src/openapi.ts and the exhaustive audience map. Do not edit it by hand.

First-party application operations

Called by the video2ctx web application or an explicit signed-in account action.

Method	Path	Operation ID	Summary	Declared access	Safety notes
`POST`	`/api/auth/api-key/create`	`createApiKey`	Create a permanent API key	`sessionCookie` or `demoUser`	Creates a secret credential; expose the returned key once and keep it out of logs and client storage.
`POST`	`/api/auth/api-key/delete`	`deleteApiKey`	Revoke an API key	`sessionCookie` or `demoUser`	Immediately revokes the selected credential; require an explicit user action.
`GET`	`/api/auth/api-key/list`	`listApiKeys`	List the current user’s API keys	`sessionCookie` or `demoUser`	Returns credential metadata; restrict it to the current signed-in account.
`GET`	`/api/auth/device`	`verifyDeviceAuthorization`	Claim a device code in the browser	`sessionCookie`	Claims a short-lived user code for the signed-in browser account; show the account and requested access before a decision.
`POST`	`/api/auth/device/approve`	`approveDeviceAuthorization`	Approve a claimed device code	`sessionCookie`	Issues CLI access after an explicit browser decision; approve only a code the user initiated on a device they control.
`POST`	`/api/auth/device/deny`	`denyDeviceAuthorization`	Deny a claimed device code	`sessionCookie`	Terminates the pending device request selected by the signed-in user without issuing a credential.
`GET`	`/api/auth/get-session`	`getAuthSession`	Get the current Better Auth session	`sessionCookie` or `cliSession`	Returns the current credential identity; never include raw cookie or bearer material in the response or logs.
`POST`	`/api/auth/sign-in/magic-link`	`signInWithMagicLink`	Send a magic sign-in link	Public or protocol-signed	Sends account email; rate-limit callers and never disclose whether an address is registered.
`POST`	`/api/auth/sign-in/social`	`signInWithSocialProvider`	Start Google sign-in	Public or protocol-signed	Starts an interactive browser sign-in; do not call it with API-key credentials.
`POST`	`/api/auth/sign-out`	`signOut`	Revoke the current browser or CLI session	`sessionCookie` or `cliSession`	Revokes the presented session; invoke it only for an explicit logout action and clear the matching local credential after success.
`DELETE`	`/v1/account`	`deleteAccount`	Permanently delete the current account	`sessionCookie` or `demoUser`	Destructive account operation; require deliberate confirmation and never automate it for a user.
`GET`	`/v1/billing`	`getBilling`	Get the signed-in account billing status	`sessionCookie`	Returns subscription state for the current browser account; do not expose another customer’s provider identifiers.
`POST`	`/v1/demo/youtube/inspect`	`inspectLandingYouTubeVideo`	Inspect a YouTube video from the landing page	Public or protocol-signed	Public, rate-limited demo route; do not use it as a credentialed bulk-data API.
`POST`	`/v1/notification-preferences/confirm-email`	`confirmNotificationEmail`	Confirm monitor email alerts from the signed-in dashboard	`sessionCookie` or `cliSession` or `bearerApiKey` or `apiKey` or `demoUser`	Enables email delivery only for the signed-in account after validating the confirmation token.
`DELETE`	`/v1/oauth/youtube`	`disconnectYouTube`	Disconnect the YouTube account	`sessionCookie` or `demoUser`	Mutates the account connection state; require an explicit user action.
`GET`	`/v1/oauth/youtube/connect`	`createYouTubeConnectUrl`	Create a YouTube OAuth URL	`sessionCookie` or `demoUser`	Returns a state-bound OAuth URL; start it only from a user-initiated connection flow.
`POST`	`/v1/resolve`	`resolveInput`	Route universal UI input	`sessionCookie` or `cliSession` or `bearerApiKey` or `apiKey` or `demoUser`	First-party input router; its dispatch behavior is not a stable public API contract.
`POST`	`/v1/scale-inquiries`	`submitScaleInquiry`	Submit a Scale plan inquiry	Public or protocol-signed	Public lead form; validate Turnstile and rate limits, and never let the caller choose the notification recipient.

Callbacks and signed links

Called by an external provider or through a signed link with protocol-specific state.

Method	Path	Operation ID	Summary	Declared access	Safety notes
`GET`	`/v1/email/unsubscribe`	`unsubscribeEmail`	Unsubscribe from email digests	Public or protocol-signed	A signed link changes email preferences; do not expose or reuse its token.
`POST`	`/v1/email/unsubscribe`	`unsubscribeEmailPost`	Unsubscribe from email digests	Public or protocol-signed	Changes email preferences; validate the signed request and avoid logging its token.
`GET`	`/v1/oauth/youtube/callback`	`completeYouTubeOAuth`	Complete YouTube OAuth	Public or protocol-signed	OAuth callback; validate state and consume authorization codes only once.

Operator operations

Reserved for authorized video2ctx platform administration.

Method	Path	Operation ID	Summary	Declared access	Safety notes
`GET`	`/v1/admin/jobs`	`listAdminJobs`	List recent jobs across users	`sessionCookie` or `demoUser`	May expose cross-account operational metadata; restrict it to authorized operators.

⌘I