> ## Documentation Index > Fetch the complete documentation index at: https://video2ctx-feat-polar-billing.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Internal endpoint inventory > Generated non-interactive inventory of first-party, callback, and operator operations. These routes are documented for transparency and maintainers. They are intentionally excluded from the interactive API playground. This page is generated from `platform/src/openapi.ts` and the exhaustive audience map. Do not edit it by hand. ## First-party application operations Called by the video2ctx web application or an explicit signed-in account action. | Method | Path | Operation ID | Summary | Declared access | Safety notes | | -------- | -------------------------------------------- | ---------------------------- | --------------------------------------------------------- | --------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | | `POST` | `/api/auth/api-key/create` | `createApiKey` | Create a permanent API key | `sessionCookie` or `demoUser` | Creates a secret credential; expose the returned key once and keep it out of logs and client storage. | | `POST` | `/api/auth/api-key/delete` | `deleteApiKey` | Revoke an API key | `sessionCookie` or `demoUser` | Immediately revokes the selected credential; require an explicit user action. | | `GET` | `/api/auth/api-key/list` | `listApiKeys` | List the current user’s API keys | `sessionCookie` or `demoUser` | Returns credential metadata; restrict it to the current signed-in account. | | `GET` | `/api/auth/device` | `verifyDeviceAuthorization` | Claim a device code in the browser | `sessionCookie` | Claims a short-lived user code for the signed-in browser account; show the account and requested access before a decision. | | `POST` | `/api/auth/device/approve` | `approveDeviceAuthorization` | Approve a claimed device code | `sessionCookie` | Issues CLI access after an explicit browser decision; approve only a code the user initiated on a device they control. | | `POST` | `/api/auth/device/deny` | `denyDeviceAuthorization` | Deny a claimed device code | `sessionCookie` | Terminates the pending device request selected by the signed-in user without issuing a credential. | | `GET` | `/api/auth/get-session` | `getAuthSession` | Get the current Better Auth session | `sessionCookie` or `cliSession` | Returns the current credential identity; never include raw cookie or bearer material in the response or logs. | | `POST` | `/api/auth/sign-in/magic-link` | `signInWithMagicLink` | Send a magic sign-in link | Public or protocol-signed | Sends account email; rate-limit callers and never disclose whether an address is registered. | | `POST` | `/api/auth/sign-in/social` | `signInWithSocialProvider` | Start Google sign-in | Public or protocol-signed | Starts an interactive browser sign-in; do not call it with API-key credentials. | | `POST` | `/api/auth/sign-out` | `signOut` | Revoke the current browser or CLI session | `sessionCookie` or `cliSession` | Revokes the presented session; invoke it only for an explicit logout action and clear the matching local credential after success. | | `DELETE` | `/v1/account` | `deleteAccount` | Permanently delete the current account | `sessionCookie` or `demoUser` | Destructive account operation; require deliberate confirmation and never automate it for a user. | | `GET` | `/v1/billing` | `getBilling` | Get the signed-in account billing status | `sessionCookie` | Returns subscription state for the current browser account; do not expose another customer’s provider identifiers. | | `POST` | `/v1/demo/youtube/inspect` | `inspectLandingYouTubeVideo` | Inspect a YouTube video from the landing page | Public or protocol-signed | Public, rate-limited demo route; do not use it as a credentialed bulk-data API. | | `POST` | `/v1/notification-preferences/confirm-email` | `confirmNotificationEmail` | Confirm monitor email alerts from the signed-in dashboard | `sessionCookie` or `cliSession` or `bearerApiKey` or `apiKey` or `demoUser` | Enables email delivery only for the signed-in account after validating the confirmation token. | | `DELETE` | `/v1/oauth/youtube` | `disconnectYouTube` | Disconnect the YouTube account | `sessionCookie` or `demoUser` | Mutates the account connection state; require an explicit user action. | | `GET` | `/v1/oauth/youtube/connect` | `createYouTubeConnectUrl` | Create a YouTube OAuth URL | `sessionCookie` or `demoUser` | Returns a state-bound OAuth URL; start it only from a user-initiated connection flow. | | `POST` | `/v1/resolve` | `resolveInput` | Route universal UI input | `sessionCookie` or `cliSession` or `bearerApiKey` or `apiKey` or `demoUser` | First-party input router; its dispatch behavior is not a stable public API contract. | | `POST` | `/v1/scale-inquiries` | `submitScaleInquiry` | Submit a Scale plan inquiry | Public or protocol-signed | Public lead form; validate Turnstile and rate limits, and never let the caller choose the notification recipient. | ## Callbacks and signed links Called by an external provider or through a signed link with protocol-specific state. | Method | Path | Operation ID | Summary | Declared access | Safety notes | | ------ | ---------------------------- | ---------------------- | ------------------------------ | ------------------------- | ----------------------------------------------------------------------------------- | | `GET` | `/v1/email/unsubscribe` | `unsubscribeEmail` | Unsubscribe from email digests | Public or protocol-signed | A signed link changes email preferences; do not expose or reuse its token. | | `POST` | `/v1/email/unsubscribe` | `unsubscribeEmailPost` | Unsubscribe from email digests | Public or protocol-signed | Changes email preferences; validate the signed request and avoid logging its token. | | `GET` | `/v1/oauth/youtube/callback` | `completeYouTubeOAuth` | Complete YouTube OAuth | Public or protocol-signed | OAuth callback; validate state and consume authorization codes only once. | ## Operator operations Reserved for authorized video2ctx platform administration. | Method | Path | Operation ID | Summary | Declared access | Safety notes | | ------ | ---------------- | --------------- | ----------------------------- | ----------------------------- | ----------------------------------------------------------------------------------- | | `GET` | `/v1/admin/jobs` | `listAdminJobs` | List recent jobs across users | `sessionCookie` or `demoUser` | May expose cross-account operational metadata; restrict it to authorized operators. |