API reference
Base URL: https://api.coback.ai/api/v1 (self-hosted: your server origin + /api/v1).
Every request carries Authorization: Bearer <workspace API key>. All data is scoped to the
workspace behind the key. The full machine-readable spec is at
/api/v1/openapi.json.
Conventions
- Errors:
{ "error": "<message>" }with a 4xx or 5xx status. - Scopes: every key reads; the write endpoints below need a key created with read and write. A read-only key gets a 403 there.
- Rate limit: 120 requests per minute per key. 429 with
Retry-Afterwhen exceeded.
Identity
| Method | Path | Returns |
|---|---|---|
| GET | /me | Workspace id and name, company name, key name, scopes |
Company brain
| Method | Path | Returns |
|---|---|---|
| GET | /brain | Knowledge cards: kind, slug, title, summary, review status |
| GET | /brain/{id} | One card with full markdown content |
| GET | /brain/export | The whole brain as one markdown file (?format=json for structured) |
| GET | /profile | The extracted company profile (digital twin) |
Laws and screening
| Method | Path | Returns |
|---|---|---|
| GET | /laws?limit=&offset=&jurisdiction=&since= | Ingested laws, newest first |
| GET | /laws/{id}/links | A law's family: transpositions, amendments, guidelines |
| GET | /sources | The monitored sources with authority and coverage |
| GET | /jurisdictions | Jurisdiction codes and names |
| GET | /matches | Screening results, highest score first (up to 100) |
| GET | /matches/irrelevant?limit=&offset= | Laws screened out, with reasoning |
| GET | /inbox | Screening results that need a decision (up to 100) |
| POST | /matches/{id}/feedback | Record { "verdict": "relevant"|"irrelevant", "note"? } (write scope) |
Work
| Method | Path | Returns |
|---|---|---|
| GET | /tasks | Tasks with status, priority, and source law |
| POST | /tasks | Create { "title", "description"?, "priority"?, "dueAt"? } (write scope) |
| PATCH | /tasks/{id} | Update status, title, priority (write scope) |
| GET | /projects | Projects with department lanes and folders |
| GET | /comments/{targetType}/{targetId} | Comment thread on a task or match |
| POST | /comments/{targetType}/{targetId} | Add { "body" } (write scope) |
Documents
| Method | Path | Returns |
|---|---|---|
| POST | /corpus/query | Semantic search: { "query", "topK"? } over the document corpus |
| POST | /corpus/documents | Multipart upload, field files (write scope) |
| POST | /corpus/urls | Ingest by URL: { "urls": [...] } (write scope) |
Product compliance
| Method | Path | Returns |
|---|---|---|
| GET | /compliance/products | Products with finding counts |
| GET | /compliance/products/{id} | Findings, BOM state, substance-of-concern summary |
| GET | /compliance/products/{id}/gaps | Data gaps: unresolved lines, missing declarations |
| GET | /compliance/products/{id}/reports | Management reports |
| GET | /compliance/resolutions | Substance resolutions pending review |
Cross-cutting
| Method | Path | Returns |
|---|---|---|
| GET | /activity?limit= | The audit trail: every change with actor and timestamp |
| GET | /search?q= | Search over laws, cards, tasks, and documents |
Writes performed with an API key appear in the activity log attributed to the key
(API: <key name>), so an agent's actions stay auditable.