Base URL: https://api.venelx.com (or your self-hosted API). The API is an Express
app; this page maps its top-level router mounts, grouped by domain, as defined in
venelx-backend/server.ts.
Two credential types, both sent as Authorization: Bearer <token>:
- Session JWT — issued at login; what the dashboard uses.
- Personal API token (
vx_...) — for scripts and the MCP server; scoped
read or write (API tokens). Write endpoints enforce the
write scope, and project routes additionally enforce project roles (build triggers
require at least the developer role).
| Mount | Description |
|---|
GET /api/health (alias /health) | Liveness/readiness probe — reports version, deploy role, queueConsumerOnApi, B2/Redis status, queue mode |
/api/system | System configuration and feature flags |
A healthy production API reports "queueConsumerOnApi": false — builds are consumed by
workers, never by the API.
| Mount | Description |
|---|
/api/auth (alias /api/v2/auth) | Signup, login, session refresh, password flows |
/api/tokens (alias /api/v2/tokens) | Personal API tokens — create/list/revoke vx_ tokens |
| Mount | Description |
|---|
/api/projects (alias /api/v2/projects) | Project CRUD and project listing |
/api/:projectId/settings | Project settings and env vars |
/api/:projectId/platform-flows | Per-platform flow configuration |
/api/:projectId/build-stack | Build stack selection per project |
/api/build-catalog | Available build definitions/platforms |
POST /api/:projectId/build/:platform | Queue a build for one platform (write scope + developer role) |
POST /api/:projectId/build-matrix | Queue builds for multiple platforms at once (write scope + developer role) |
/api/:projectId/artifacts (alias /api/v2/artifacts) | Build artifacts — list, download tokens |
GET /api/storage/download-token | Presigned download token for an artifact |
/api/internal/build-jobs | Internal — worker→API log ingest and job updates (agent token only) |
Build triggers surface a skipReason (e.g. signing_not_ready,
github_token_invalid) when a build can't start — the same values the MCP
trigger_build tool reports.
| Mount | Description |
|---|
/api/signing | Account-level signing credentials |
/api/:projectId/signing | Per-project iOS/Android signing — upload, status, provisioning |
| Mount | Description |
|---|
/api/github | GitHub App OAuth flow, repo listing, connection status, token refresh |
GET /api/auth/github-status | Shorthand alias for the GitHub connection status |
/api/gitlab | GitLab integration (optional) |
| Mount | Description |
|---|
/api/teams (alias /api/v2/teams) | Teams, membership, roles, team secrets |
/api/billing | Plans, subscriptions, customer portal |
/api/webhooks | Inbound webhooks (raw body, HMAC-verified) |
/api/webhooks/billing | Lemon Squeezy billing webhooks |
/api/enterprise | Enterprise features and licensing |
| Mount | Description |
|---|
/api/workers (alias /api/v2/workers) | Worker fleet — register, heartbeat, drain/stop, assign |
/api/me/workers (alias /api/customer-workers) | Customer self-hosted workers — create, pairing tokens, status |
/api/backend | Self-host backend installer downloads |
Workers primarily talk over WebSocket (/ws/worker); the HTTP heartbeat/claim
endpoints are the fallback.
| Mount | Description |
|---|
/api/ota | Public OTA update endpoints |
/api/:projectId/ota | Project OTA bundle management |
/ota-static | Static serving of OTA bundles |
/api/store | App-store submit (App Store / Google Play) |
/api/push (alias /api/v2/push) | Push notification registration and send |
/api/recovery | Account/project recovery flows |
| Mount | Description |
|---|
/api/admin (alias /api/v2/admin) | Admin — users, workers, system config, entitlements |
GET /api/:projectId/health | Per-project health (routed via admin) |
GET /api/storage | Storage overview (routed via admin) |
/api/v2/admin/artifacts | Admin artifact management |
/api/analytics | Usage and build analytics |
/api/v2/* mounts alias the current routers for compatibility — /api/v2/auth,
/api/v2/projects, /api/v2/teams, /api/v2/workers, /api/v2/admin, and friends
behave identically to their unversioned counterparts. New integrations should use the
unversioned paths above.
