> ## Documentation Index
> Fetch the complete documentation index at: https://synthetiq.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# HTTP API

> Auto-generated HTTP endpoints from tRPC procedures

Every tRPC procedure is available as a plain HTTP endpoint at `<app-url>/api/`.

## Discovery

```bash theme={null}
GET <app-url>/api
```

Returns the full API manifest including OAuth configuration and all available procedures. Each procedure includes its path, description, HTTP method, input/output schemas, and required scopes:

```json theme={null}
{
  "auth": {
    "type": "oauth2",
    "authorizationEndpoint": "/oauth/authorize",
    "tokenEndpoint": "/oauth/token",
    "revocationEndpoint": "/oauth/revoke",
    "discoveryEndpoint": "/.well-known/openid-configuration",
    "grantTypes": ["authorization_code", "refresh_token"],
    "codeChallengeMethod": "S256"
  },
  "procedures": [
    {
      "name": "/api/tasks/getMyTasks",
      "description": "Get all tasks for the current user",
      "method": "GET",
      "inputSchema": null,
      "outputSchema": null,
      "requiredScopes": null
    },
    {
      "name": "/api/tasks/createTask",
      "description": "Create a new task",
      "method": "POST",
      "inputSchema": {
        "title": { "type": "string", "required": true },
        "priority": { "type": "string", "required": false }
      },
      "outputSchema": null,
      "requiredScopes": ["tasks:write"]
    }
  ]
}
```

<Tip>This discovery response contains everything an AI agent needs to build a [Synthetiq service](/docs/platform-docs/services-framework/overview) for the app's API.</Tip>

## Queries (GET)

```bash theme={null}
GET <app-url>/api/tasks/getMyTasks
```

## Mutations (POST)

```bash theme={null}
curl -X POST <app-url>/api/tasks/createTask \
  -H "Authorization: Bearer <jwt>" \
  -H "Content-Type: application/json" \
  -d '{"title": "New task"}'
```

## Authentication

Protected procedures require a valid access token in the `Authorization: Bearer <token>` header. Tokens are obtained through the app's built-in [OAuth 2.0 provider](/docs/platform-docs/app-framework/headless/oauth). Public procedures (`publicProcedure`) can be called without authentication. Responses are plain JSON without the tRPC envelope.