API Reference

The Hono API is served under /api. This page lists routes verified in the Worker source; it does not infer payloads, response shapes, or undocumented error codes.

Authentication and tenant context

Authenticated routes accept Legal Hub’s signed app session either as the pcnaid_access_token cookie or as a bearer token. Send X-Organization-Id when selecting an organization; it is required when the user has more than one active organization membership. Cookie-authenticated POST, PUT, PATCH, and DELETE requests must copy the pcnaid_csrf_token cookie into the X-CSRF-Token header. Bearer-token requests do not use the cookie CSRF check.

Health check

curl https://app.legalhub.pndsvcs.com/api/health

GET /api/health is public and returns the Worker health status, current timestamp, and version.

Public routes

Method	Route	Purpose
`GET`	`/api/health`	Returns Worker health, timestamp, and app version.
`POST`	`/api/contact`	Accepts verified public contact submissions and queues notifications.
`POST`	`/api/auth/callback`	Exchanges Auth0 authorization codes and sets HttpOnly cookies.
`POST`	`/api/auth/e2e-login`	Issues a secret-gated session for the single fixed QA identity.
`GET`	`/api/brand-for-host`	Resolves white-label brand, audience, and firm context from host or slug.

Authenticated resource routes

Method	Route prefix	Purpose
`GET`	`/api/me`	Returns the authenticated user and tenant context.
`GET, POST, PATCH`	`/api/organizations`	Creates, reads, updates, and reports organization usage.
`GET, PUT`	`/api/brands`	Reads and updates organization branding.
`GET, POST, PATCH, DELETE`	`/api/memberships`	Manages organization users, roles, and permissions.
`GET, POST, PATCH`	`/api/clients`	Manages client records and details.
`GET, POST, PATCH`	`/api/client-contacts`	Manages client contact people.
`GET, POST, PATCH, DELETE`	`/api/client-access`	Grants and revokes portal access.
`GET, POST, PATCH`	`/api/forms`	Manages intake form definitions.
`GET, POST, PATCH`	`/api/intakes`	Manages intake records and converts intakes to clients and matters.
`GET, POST, PATCH`	`/api/matters`	Manages legal matters and matter detail pages.
`GET, POST, PATCH, DELETE`	`/api/matter-assignments`	Manages matter team assignments.
`GET, POST, PATCH, DELETE`	`/api/matter-notes`	Manages internal and client-visible matter notes.
`GET, POST, PATCH`	`/api/tasks`	Manages tasks, deadlines, and reminders.
`GET, POST, PATCH`	`/api/documents`	Manages document records and metadata.
`GET, POST`	`/api/document-versions`	Manages document versions.
`POST, PUT`	`/api/uploads`	Starts, streams, and completes R2 multipart uploads.
`GET, POST, PATCH`	`/api/esign`	Manages e-sign requests and recipients.
`GET, POST, PATCH`	`/api/appointments`	Manages appointment records.
`GET, POST, PATCH`	`/api/invoices`	Manages invoices and invoice send/finalize actions.
`GET, POST, PATCH, DELETE`	`/api/invoice-items`	Manages invoice line items.
`GET, POST`	`/api/payments`	Manages payment records.
`GET, POST`	`/api/retainers`	Manages retainers and deposits.
`GET, POST, PATCH`	`/api/time-entries`	Manages billable time entries.
`GET, POST, PATCH`	`/api/expense-entries`	Manages expense entries.
`GET, POST, PATCH`	`/api/threads`	Manages communication threads.
`GET, POST`	`/api/messages`	Reads and sends portal messages.
`GET, POST, PATCH`	`/api/notification-templates`	Manages notification templates.
`GET, POST, PATCH, DELETE`	`/api/integrations`	Manages connected provider accounts.
`POST, GET`	`/api/ai`	Runs AI queries and returns AI conversations.
`GET`	`/api/reports`	Returns dashboard, A/R, and usage reports.
`GET, POST`	`/api/practice-tools`	Runs timers, conflict checks, deadline calculation, templates, LEDES, workflows, notifications, and trust reconciliation.
`GET, POST`	`/api/portal`	Powers client portal matter, document, invoice, form, appointment, payment, and preference interactions.
`GET, POST`	`/api/pcnaid`	Pcnaid staff-only cross-tenant administration and support operations.

Upload endpoints

Method	Route	Purpose
`POST`	`/api/uploads/presigned-url`	Creates an R2 multipart upload and returns upload metadata.
`PUT`	`/api/uploads/multipart/:uploadId/parts/:partNumber`	Streams an upload part through the Worker to R2.
`POST`	`/api/uploads/complete`	Completes the multipart upload and queues document processing.

Authenticated request example

curl -H "Authorization: Bearer $LEGALHUB_SESSION" -H "X-Organization-Id: $LEGALHUB_ORG_ID" https://app.legalhub.pndsvcs.com/api/me

Webhook endpoints

Method	Route	Provider	Purpose
`POST`	`/api/webhooks/stripe`	Stripe	Records billing and payment events.
`POST`	`/api/webhooks/twilio`	Twilio	Receives inbound SMS and creates message records.
`POST`	`/api/webhooks/cal`	Cal.com	Receives scheduling events.
`POST`	`/api/webhooks/auth0`	Auth0	Receives identity lifecycle events.

Webhook receipts are persisted in webhookEvents with provider and external event IDs for duplicate detection.

Start here

Documentation hubs

Legal

Shared legal

API Reference

API Reference

Authentication and tenant context

Health check

Public routes

Authenticated resource routes

Upload endpoints

Authenticated request example

Webhook endpoints

​API Reference

​Authentication and tenant context

​Health check

​Public routes

​Authenticated resource routes

​Upload endpoints

​Authenticated request example

​Webhook endpoints

API Reference

Authentication and tenant context

Health check

Public routes

Authenticated resource routes

Upload endpoints

Authenticated request example

Webhook endpoints