> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plansync.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Public and Internal Endpoints

> Which endpoints are safe for customer-facing use and which are internal-only.

# Public and Internal Endpoints

This page helps integration teams separate supported public routes from internal automation routes.

## Public routes (no member session required)

### Health and branding

* `GET /api/v1/health`
* `GET /api/v1/public/workspaces/:workspaceId/logo`
* `GET /api/v1/public/brand/email-icon.png`
* `POST /api/v1/public/marketing/chat`

### Invite token validation/acceptance

* `GET /api/v1/invites/:token`
* `GET /api/v1/email-invites/:token`
* `POST /api/v1/invites/:token/accept`
* `POST /api/v1/email-invites/:token/accept`

### Proposal portal (tokenized)

* `GET /api/v1/public/proposals/:token`
* `POST /api/v1/public/proposals/:token/view`
* `POST /api/v1/public/proposals/:token/accept`
* `POST /api/v1/public/proposals/:token/decline`
* `POST /api/v1/public/proposals/:token/request-changes`
* `GET /api/v1/public/proposals/:token/messages`
* `POST /api/v1/public/proposals/:token/messages`

### Occupant portal (tokenized)

* `GET /api/v1/occupant/:token/meta`
* `POST /api/v1/occupant/:token/submit`
* `POST /api/v1/occupant/:token/issues/:issueId/reference-photos/presign`
* `POST /api/v1/occupant/:token/issues/:issueId/reference-photos/complete`

## Internal automation routes (not customer integration APIs)

These are intended for trusted infrastructure (scheduled jobs/ops) only:

* `GET /api/v1/internal/collab-metrics`
* `POST /api/v1/internal/om-maintenance-reminders` — daily PPM email + push digests (assignees + workspace managers; meter-threshold schedules labeled Meter/calendar). Authenticate with header `x-plansync-cron-secret: INTERNAL_CRON_SECRET`.
* `POST /api/v1/internal/om-inspection-reminders` — daily inspection template digests (managers) for templates overdue or due within 7 days (UTC). Same cron secret header.
* `POST /api/v1/internal/om-work-order-aging-reminders` — daily manager digests for open/in-progress work orders older than 7 and 30 days. Same cron secret header.
* `POST /api/v1/internal/proposal-reminders`

Use secret-based protection and private network controls for these routes. Schedule the OM reminder jobs once per day in your deploy environment.

## Stripe webhook route

* `POST /api/stripe/webhook`

This route is for Stripe to call your backend, not for customer system integrations.

## Security recommendations

* Do not expose internal endpoints in public API clients
* Rotate and revoke leaked tokens quickly
* Keep audit and observability around all external callback and public-token traffic

## Example: occupant submit

```bash theme={null}
curl -X POST "https://api.plansync.dev/api/v1/occupant/<token>/submit" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "AC not cooling in unit 807",
    "description": "Started this morning and still blowing warm air.",
    "reporterName": "Sam Lee",
    "reporterEmail": "sam@example.com"
  }'
```