​

Public and Internal Endpoints

​

Public routes (no member session required)

​

Health and branding

• GET /api/v1/health
• GET /api/v1/public/workspaces/:workspaceId/logo
• GET /api/v1/public/brand/email-icon.png
• POST /api/v1/public/marketing/chat

​

Invite token validation/acceptance

• GET /api/v1/invites/:token
• GET /api/v1/email-invites/:token
• POST /api/v1/invites/:token/accept
• POST /api/v1/email-invites/:token/accept

​

Proposal portal (tokenized)

• GET /api/v1/public/proposals/:token
• POST /api/v1/public/proposals/:token/view
• POST /api/v1/public/proposals/:token/accept
• POST /api/v1/public/proposals/:token/decline
• POST /api/v1/public/proposals/:token/request-changes
• GET /api/v1/public/proposals/:token/messages
• POST /api/v1/public/proposals/:token/messages

​

Occupant portal (tokenized)

• GET /api/v1/occupant/:token/meta
• POST /api/v1/occupant/:token/submit
• POST /api/v1/occupant/:token/issues/:issueId/reference-photos/presign
• POST /api/v1/occupant/:token/issues/:issueId/reference-photos/complete

​

Internal automation routes (not customer integration APIs)

• GET /api/v1/internal/collab-metrics
• POST /api/v1/internal/om-maintenance-reminders — daily PPM email + push digests (assignees + workspace managers; meter-threshold schedules labeled Meter/calendar). Authenticate with header x-plansync-cron-secret: INTERNAL_CRON_SECRET.
• POST /api/v1/internal/om-inspection-reminders — daily inspection template digests (managers) for templates overdue or due within 7 days (UTC). Same cron secret header.
• POST /api/v1/internal/om-work-order-aging-reminders — daily manager digests for open/in-progress work orders older than 7 and 30 days. Same cron secret header.
• POST /api/v1/internal/proposal-reminders

​

Stripe webhook route

• POST /api/stripe/webhook

​

Security recommendations

• Do not expose internal endpoints in public API clients
• Rotate and revoke leaked tokens quickly
• Keep audit and observability around all external callback and public-token traffic

​

Example: occupant submit

curl -X POST "https://api.plansync.dev/api/v1/occupant/<token>/submit" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "AC not cooling in unit 807",
    "description": "Started this morning and still blowing warm air.",
    "reporterName": "Sam Lee",
    "reporterEmail": "sam@example.com"
  }'