HouseholdOS HTTP route inventory
This is an implementation inventory, not a promise of a stable public API. The reviewed source contains no OpenAPI document, API version prefix, or external-consumer SDK. Request and response examples are omitted except for the source-verified public health check. Most routes below belong to the application service; the final contact route belongs to the separate marketing site.Authentication
On the application origin,GET /api/health is public and GET /api/health/db uses separate readiness authorization. The read-only calendar subscription at GET /api/integrations/calendar/feed/:secret.ics also does not require an application session: its unguessable URL is the access credential. Anyone with the complete URL can read the feed, so keep it private and regenerate it if it is exposed. All other /api/* routes first authenticate the caller; household routes then apply membership and permission checks where relevant. Browser mutations with a cross-origin Origin are rejected unless the origin is allowed by application configuration.
The primary browser flow uses the same-origin session established by /auth/login and /auth/callback. Supported non-browser credentials are validated before route dispatch.
Public health check
{"status":"ok"}.
API routes
Marketing Pages Function
The form sends name, email, topic, and message fields.
Partnerships is one of the implemented topic choices. The function returns a service-unavailable response if it can neither persist nor email a valid submission.