Owner-only view of the existing MessyAPI platform and how each part is represented in the new experience. Owner-only access will be enforced once sign-in is connected.
| Capability | Endpoint | Current implementation | New representation | Verification | Status |
|---|---|---|---|---|---|
| Capability API (~80 operations) | /api/v1/* | Next.js route → withApiAuth → lib/services | Catalog, docs, playground (proxy) | Live-probed | Inventoried |
| Repair / Map / Guard demos | /api/v1/demo/* | Keyless, IP rate-limited, unmetered | Homepage interactive demo (live) | Live-probed | Connected |
| /process orchestrator | /api/v1/process | lib/operations/process | Workflow builder (generates + runs /process) | Code-inspected | Inventoried |
| Health | /api/health | DB + config check | Status page, dashboard API status | Live-probed | Connected |
| OpenAPI spec | /docs/openapi.json | lib/openapi.ts | Catalog + API reference (snapshot) + live counts | Live-probed | Connected |
| MCP endpoint | /mcp | app/mcp/route.ts + lib/zapinner/* | MCP onboarding + live tool listing | Live-probed | Connected |
| Dashboard sign-in | Supabase Auth (existing project) | @supabase/ssr, getUser() | Sign-in screen — integration pending | Code-inspected | Inventoried |
| API keys | dashboard server actions | SHA-256 hashed, messy_live_/messy_test_ | Keys UI (development data) | Code-inspected | Inventoried |
| Usage | /api/v1/usage | usage_counters, usage_events | Usage UI (development data) | Code-inspected | Inventoried |
| Request inspector | /api/v1/requests/{id} | api_requests table | Requests UI (development data) | Code-inspected | Inventoried |
| Async jobs | /api/v1/jobs | Postgres queue + 1-min cron | Jobs UI (development data) | Code-inspected | Inventoried |
| Projects / pipelines / recipes | /api/v1/pipelines/{id}/run | projects, pipelines, pipeline_versions, project_variables, recipes | Projects UI (development data) | Code-inspected | Inventoried |
| Billing | Stripe checkout/portal + webhook | lib/stripe.ts, stripe_events, reconcile cron | Billing UI (display only) | Code-inspected | Inventoried |
| RapidAPI | same /api/v1 routes | lib/rapidapi.ts proxy-secret detection | Docs + admin status only | Code-inspected | Inventoried |
| SDKs / CLI | @zapinner/sdk, zapinner (PyPI), @zapinner/cli | packages/* | Docs | Code-inspected | Inventoried |
| Referrals programme | /api/referral/claim | referral_* tables + cron | Not rebuilt — owner decision | Code-inspected | Inventoried |
| Compliance admin | /dashboard/admin/compliance | compliance_* tables | Not rebuilt — owner decision | Code-inspected | Inventoried |
| Customer webhooks | — | Does not exist | Shown as Planned | Code-inspected | Not inventoried |
| Endpoint | Purpose | Inputs | Metering | Unique | Overlap with /process | Plan |
|---|---|---|---|---|---|---|
| /api/v1/process | Chain record-stream operations over one working set. | data[], steps[{operation, options, against}] | Σ records_in × op weight | Primary model. 25 chainable ops (spec enum). | — | Primary UX target |
| /api/v1/analyze | Run several suite ops (normalize, match, dedupe, anomalies, score, explain…) independently over one payload. | dataset(s) + operations[] (≤12) | Sum of ops that actually ran, de-duplicated | Partial-failure isolation; suite ops not in /process enum. | High — different op set | Preserve |
| /api/v1/pipeline | Ad-hoc multi-step pipeline (per spec). | See spec | Per spec | Requires verification | High | Preserve |
| /api/v1/pipelines/{id}/run | Run a saved, versioned project pipeline. | pipeline id + data | Per step | Saved versions + project variables | Medium | Preserve (not in spec) |
| /api/v1/workflows/run | Limited-preview orchestration layer, feature-flagged per account. | See spec | Per spec | Feature-flag gated | High | Preserve |
| /api/v1/execute | Limited-preview orchestration, feature-flagged per account. | See spec | Per spec | Feature-flag gated | High | Preserve |
Known consumers and per-endpoint tests: /process, /pipeline and pipelines/run have HTTP tests (process, api-pipeline-http, pipeline-http); consumer list needs request-log analysis.
Every published path exists in code. The difference is routes intentionally kept out of the public spec:
| /api/v1/whoami | Account introspection; used by SDK/CLI. Undocumented in spec. | customer-facing · add to spec? |
| /api/v1/requests/{requestId} | Request inspector lookup; undocumented in spec. | customer-facing · add to spec? |
| /api/v1/pipelines/{id}/run | Saved-pipeline runner (Projects); undocumented in spec. | customer-facing · add to spec? |
| /api/v1/demo/{repair,map,guard,reconcile,recovery,revenue-leak,verify} | Keyless, IP rate-limited, unmetered marketing demos. | internal |
| /api/v1/rapidapi/diagnostics | RapidAPI integration diagnostics. | internal |
| /api/health/live, /api/health/ready | Liveness / readiness probes. | internal |
| /api/cron/* (drain-jobs, health-alerts, reconcile-billing, referral-rewards) | Vercel cron, secret-authenticated. | internal |
| /api/stripe/webhook | Inbound Stripe webhook (signature verified). | internal |
| /api/admin/compliance/export | Admin compliance evidence export. | internal |
| /api/public/founding-promo, /api/referral/claim | Promotions / referral programme. | internal |
Scopes are documented but not enforced. Not shown as a security control.
RLS disabled on all ~45 tables; tenant isolation is enforced in withApiAuth + organizationId scoping, covered by tenant-isolation and tenant-scope-guard tests. Risk: backend uses direct pg/Drizzle connection; policies must not block it.
No customer webhook system exists. Only Stripe and internal alert webhooks.
Needs the existing project's public URL + publishable key and allowed redirect URLs.
Org-scoped endpoints for keys list, usage series, requests, jobs, billing state.
| Homepage + Repair demo | / | Improve | Rebuilt; demo still calls real keyless endpoint. |
| Repair / Map / Guard | / (flagship section) | Preserve | First-class in nav and homepage. |
| APIs / capabilities | / + docs | Improve | Searchable catalog from live spec. |
| Playground | /playground | Improve | Dashboard playground over spec; keyless demos public. |
| Pricing | /pricing | Preserve | Same plans, same numbers. |
| Dashboard | /dashboard/* | Improve | Rebuilt UI; data integration pending. |
| Docs (≈25 pages) | /docs/* | Improve | Rebuilt around current implementation. |
| API Reference | /docs/api-reference | Improve | Generated from spec. |
| OpenAPI / Postman downloads | /docs/openapi.json, /docs/postman.json | Preserve | Linked to existing production files; URLs unchanged. |
| Changelog | /docs/changelog | Merge | Public changelog page; owner to supply entries. |
| Status | /status | Improve | Live health probe. |
| Support / Contact | footer | Improve | Contact page; support address needs owner confirmation. |
| Blog (3 posts) | /blog/* | Owner decision | Not rebuilt in Phase 1 — keep live on existing site. |
| Resources (≈20 guides) | /resources/* | Owner decision | SEO content; keep URLs live or redirect 1:1. |
| Compare (3) | /compare/* | Owner decision | Not rebuilt in Phase 1. |
| Recipes (11) | /recipes/* | Merge | Recipes concept in dashboard Projects; public pages keep URLs. |
| Solutions (6) + SEO landers (6) | /solutions/*, /crm-data-cleaning… | Merge | Use Cases page; keep URLs or redirect 1:1. |
| Case studies | /case-studies/* | Owner decision | Must verify claims before republishing. |
| Refer & Earn | /refer | Owner decision | Programme still live on backend. |
| Privacy / Terms / Acceptable Use | /privacy, /terms, /acceptable-use | Preserve | Legal text NOT rewritten; pages point to authoritative versions. |
| Cookies | /cookies | Preserve | Same as above. |
| Security | /security | Improve | Implemented vs planned clearly separated. |