API overview

The Miqro backend is a single FastAPI service. This page covers how to talk to it: base URLs, authentication, and conventions. For the live list of endpoints, see the API reference.

Scope. This documents the public and customer-facing surface of the API. Operator-only and internal service-to-service endpoints (agent execution, internal-key routes) exist but are intentionally not enumerated publicly.

Base URL

All HTTP endpoints are served by the one backend, host-routed. API routes live under the /api prefix and are host-agnostic — they answer on whichever Miqro host the request arrives on:

https://miqromanage.app/api/...
https://miqrodesign.com/api/...

A health probe is available at GET /health and returns the deployed git commit so deploy state is verifiable without dashboard access.

Authentication

There are three ways a request is authenticated, depending on the caller:

Caller	Mechanism	Header
A signed-in user / SPA	Supabase JWT	`Authorization: Bearer <token>`
Browser SSO flows	session cookie	`Domain=.miqromanage.app` cookie
Internal service-to-service	internal key (fail-closed)	`X-Internal-Key: <key>`

The JWT carries the user's role and tenant_id; the server maps these to what the caller is allowed to read or do. Row-level security enforces tenant scope at the database.
The internal key path is fail-closed and restricted to an allowlist — it is how trusted internal workers (e.g. agent execution) call privileged endpoints. It is not a public credential.

Public endpoints (form submissions, booking capture, support ticket creation, the connector catalog) require no auth but are rate-limited and SSRF-guarded.

Conventions

Format: JSON request and response bodies; Content-Type: application/json.
Prefix: API routes are under /api; a few first-class non-API routes exist (/health, published sites at /site/{slug}, activation at /activate/{token}).
Errors: standard HTTP status codes; 4xx for client errors (validation, auth, rate limit), 5xx for server errors.
Rate limiting: the free/public intake and capture endpoints are rate-limited; abusive callers get 429.

Public surface, by area

The customer-facing areas of the API:

Integrations catalog — GET /api/integrations/catalog and /api/integrations/catalog/{provider}: the live connector manifest (the same data behind the Connectors pages).
Forms — POST /api/forms/submit: form submissions from published sites.
Bookings — /api/bookings: booking capture (Assist-tier module).
Subscribers — /api/subscribers: newsletter capture.
Support — /api/support/...: knowledge-base search, ticket creation, and requester status (the public Support Desk API).
Billing — /api/billing/checkout (Stripe checkout) and /api/billing/webhook (Stripe events).

See the API reference for the live, generated list with methods and summaries.

Interactive schema

In non-production environments the service also exposes Swagger UI at /docs, ReDoc at /redoc, and the raw schema at /openapi.json. These are disabled in production by design.