> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pcnaid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Reference

> Authentication rules and verified HTTP routes implemented by the Legal Hub Worker.

# API Reference

The Hono API is served under `/api`. This page lists routes verified in the Worker source; it does not infer payloads, response shapes, or undocumented error codes.

## Authentication and tenant context

Authenticated routes accept Legal Hub's signed app session either as the `pcnaid_access_token` cookie or as a bearer token. Send `X-Organization-Id` when selecting an organization; it is required when the user has more than one active organization membership.

Cookie-authenticated `POST`, `PUT`, `PATCH`, and `DELETE` requests must copy the `pcnaid_csrf_token` cookie into the `X-CSRF-Token` header. Bearer-token requests do not use the cookie CSRF check.

## Health check

```bash theme={null}
curl https://app.legalhub.pndsvcs.com/api/health
```

`GET /api/health` is public and returns the Worker health status, current timestamp, and version.

## Public routes

| Method | Route | Purpose |
| - | - | - |
| `GET` | `/api/health` | Returns Worker health, timestamp, and app version. |
| `POST` | `/api/contact` | Accepts verified public contact submissions and queues notifications. |
| `POST` | `/api/auth/callback` | Exchanges Auth0 authorization codes and sets HttpOnly cookies. |
| `POST` | `/api/auth/e2e-login` | Issues a secret-gated session for the single fixed QA identity. |
| `GET` | `/api/brand-for-host` | Resolves white-label brand, audience, and firm context from host or slug. |

## Authenticated resource routes

| Method | Route prefix | Purpose |
| - | - | - |
| `GET` | `/api/me` | Returns the authenticated user and tenant context. |
| `GET, POST, PATCH` | `/api/organizations` | Creates, reads, updates, and reports organization usage. |
| `GET, PUT` | `/api/brands` | Reads and updates organization branding. |
| `GET, POST, PATCH, DELETE` | `/api/memberships` | Manages organization users, roles, and permissions. |
| `GET, POST, PATCH` | `/api/clients` | Manages client records and details. |
| `GET, POST, PATCH` | `/api/client-contacts` | Manages client contact people. |
| `GET, POST, PATCH, DELETE` | `/api/client-access` | Grants and revokes portal access. |
| `GET, POST, PATCH` | `/api/forms` | Manages intake form definitions. |
| `GET, POST, PATCH` | `/api/intakes` | Manages intake records and converts intakes to clients and matters. |
| `GET, POST, PATCH` | `/api/matters` | Manages legal matters and matter detail pages. |
| `GET, POST, PATCH, DELETE` | `/api/matter-assignments` | Manages matter team assignments. |
| `GET, POST, PATCH, DELETE` | `/api/matter-notes` | Manages internal and client-visible matter notes. |
| `GET, POST, PATCH` | `/api/tasks` | Manages tasks, deadlines, and reminders. |
| `GET, POST, PATCH` | `/api/documents` | Manages document records and metadata. |
| `GET, POST` | `/api/document-versions` | Manages document versions. |
| `POST, PUT` | `/api/uploads` | Starts, streams, and completes R2 multipart uploads. |
| `GET, POST, PATCH` | `/api/esign` | Manages e-sign requests and recipients. |
| `GET, POST, PATCH` | `/api/appointments` | Manages appointment records. |
| `GET, POST, PATCH` | `/api/invoices` | Manages invoices and invoice send/finalize actions. |
| `GET, POST, PATCH, DELETE` | `/api/invoice-items` | Manages invoice line items. |
| `GET, POST` | `/api/payments` | Manages payment records. |
| `GET, POST` | `/api/retainers` | Manages retainers and deposits. |
| `GET, POST, PATCH` | `/api/time-entries` | Manages billable time entries. |
| `GET, POST, PATCH` | `/api/expense-entries` | Manages expense entries. |
| `GET, POST, PATCH` | `/api/threads` | Manages communication threads. |
| `GET, POST` | `/api/messages` | Reads and sends portal messages. |
| `GET, POST, PATCH` | `/api/notification-templates` | Manages notification templates. |
| `GET, POST, PATCH, DELETE` | `/api/integrations` | Manages connected provider accounts. |
| `POST, GET` | `/api/ai` | Runs AI queries and returns AI conversations. |
| `GET` | `/api/reports` | Returns dashboard, A/R, and usage reports. |
| `GET, POST` | `/api/practice-tools` | Runs timers, conflict checks, deadline calculation, templates, LEDES, workflows, notifications, and trust reconciliation. |
| `GET, POST` | `/api/portal` | Powers client portal matter, document, invoice, form, appointment, payment, and preference interactions. |
| `GET, POST` | `/api/pcnaid` | Pcnaid staff-only cross-tenant administration and support operations. |

## Upload endpoints

| Method | Route | Purpose |
| - | - | - |
| `POST` | `/api/uploads/presigned-url` | Creates an R2 multipart upload and returns upload metadata. |
| `PUT` | `/api/uploads/multipart/:uploadId/parts/:partNumber` | Streams an upload part through the Worker to R2. |
| `POST` | `/api/uploads/complete` | Completes the multipart upload and queues document processing. |

## Authenticated request example

```bash theme={null}
curl -H "Authorization: Bearer $LEGALHUB_SESSION" -H "X-Organization-Id: $LEGALHUB_ORG_ID" https://app.legalhub.pndsvcs.com/api/me
```

## Webhook endpoints

| Method | Route | Provider | Purpose |
| - | - | - | - |
| `POST` | `/api/webhooks/stripe` | Stripe | Records billing and payment events. |
| `POST` | `/api/webhooks/twilio` | Twilio | Receives inbound SMS and creates message records. |
| `POST` | `/api/webhooks/cal` | Cal.com | Receives scheduling events. |
| `POST` | `/api/webhooks/auth0` | Auth0 | Receives identity lifecycle events. |

Webhook receipts are persisted in `webhookEvents` with provider and external event IDs for duplicate detection.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.