REST API

Every path is prefixed /api. Authentication is a bearer token, or the session cookie the web app sets:

Authorization: Bearer slk_...

Responses are JSON. Errors are { "error": "..." } with a matching status.

Note

There is no separate versioning scheme yet, and no OpenAPI document. Slick is early, and this reference is maintained by hand against the routes. If you find a discrepancy, the routes in apps/server/src/modules/ are the truth.

Setup and auth

Method	Path	Notes
GET	/setup	{ needsSetup }. True on a fresh install
POST	/setup	Creates the first owner and workspace. Fails once set up
POST	/auth/login	{ email, password }, returns a token and sets a cookie
POST	/auth/logout	Revokes the current session
GET	/me	The signed-in user, their workspaces, settings, and capabilities
PATCH	/me	{ displayName?, avatarFileId? }
PATCH	/me/settings	Merges a partial settings object

Workspaces

Method	Path	Notes
POST	/workspaces	Subject to WORKSPACE_CREATION
PATCH	/workspaces/:id	Name, icon, accent. Admin
DELETE	/workspaces/:id	Owner only. Body must echo the workspace name
GET	/workspaces/:id/members
PATCH	/workspaces/:id/members/:userId	Change role. Admin
DELETE	/workspaces/:id/members/:userId	Remove, or leave if it is you
GET	/workspaces/:id/bootstrap	One-shot state for a cold start

Invites

Method	Path	Notes
GET	/workspaces/:id/invites	Admin
POST	/workspaces/:id/invites	{ role, email? }, returns a code
POST	/workspaces/:id/invites/email	Mails invites. Needs SMTP
DELETE	/workspaces/:id/invites/:inviteId	Revoke
GET	/invites/:code	Public. Preview before accepting
POST	/invites/:code/accept	Creates the account and signs in

Channels

Method	Path	Notes
GET	/workspaces/:id/channels	Channels you can see
POST	/workspaces/:id/channels	{ name, type }
PATCH	/channels/:id	Name, topic
POST	/channels/:id/join	Public channels
POST	/channels/:id/leave
POST	/channels/:id/members	{ userIds }
POST	/channels/:id/archive
POST	/workspaces/:id/dms	{ userIds }. Reuses an existing conversation
GET	/channels/:id/notes	The shared channel note
PUT	/channels/:id/notes	Last write wins

Messages

Method	Path	Notes
GET	/channels/:id/messages	Cursor paginated, newest first
POST	/channels/:id/messages	{ id, content, threadRootId?, fileIds? }
PATCH	/channels/:id/messages/:messageId	Edit your own
DELETE	/channels/:id/messages/:messageId	Soft delete
GET	/messages/:rootId/thread	Replies to a root
PUT	/messages/:id/reactions	{ emoji }
DELETE	/messages/:id/reactions	{ emoji }
PUT	/channels/:id/read	Mark read up to a message

The id on send is yours to generate. Mint a ULID client side and reuse it on retry: the server ignores a duplicate rather than posting twice.

Files

Method	Path	Notes
POST	/workspaces/:id/uploads	Multipart. Returns a file record
GET	/files/:fileId/:name	Authenticated. Supports Range and ETag

Upload first, then reference the returned id in fileIds when sending. An upload that is never attached is cleaned up after 24 hours.

Search

Method	Path	Notes
GET	/workspaces/:id/search?q=	Supports the filter syntax

Bots

Method	Path	Notes
GET	/workspaces/:id/bots	Admin
POST	/workspaces/:id/bots	{ name }, returns a token once
DELETE	/workspaces/:id/bots/:tokenId	Revokes immediately

Webhooks

Method	Path	Notes
GET	/workspaces/:id/webhooks	Admin. Never includes the secret
POST	/workspaces/:id/webhooks	{ url, events, includePrivate? }; returns the secret once
DELETE	/workspaces/:id/webhooks/:webhookId
POST	/workspaces/:id/webhooks/:webhookId/enable	Re-enable after failures, resuming from now

See Outbound webhooks for the payload and signature.

Calls and push

Method	Path	Notes
GET	/ice	ICE servers with fresh, expiring TURN credentials
GET	/push/key	VAPID public key
POST	/push/subscriptions	Register a browser subscription
DELETE	/push/subscriptions	{ endpoint }

Encryption keys

Method	Path	Notes
PUT	/devices	Publish a device’s public keys
GET	/channels/:id/devices	Devices to seal a channel key to
GET	/channels/:id/keys	Sealed envelopes for your device
POST	/channels/:id/keys	Publish a rotated channel key

The server stores public keys and sealed blobs. It holds nothing that can decrypt a message.