The API is the product

Shape

Command-and-query over project resources. GET /v1/routes lists every endpoint — 285 of them, 30 reachable without a credential — and that list is the documentation rather than a copy of it.

POST  /v1/projects/:projectId/lessons
      Capture a lesson against the project that produced it
POST  /v1/projects/:projectId/quality/plans
      Create an inspection and test plan for a work package
POST  /v1/projects/:projectId/quality/inspections
      Record an inspection against an ITP stage; a failure raises an NCR
POST  /v1/projects/:projectId/quality/ncrs
      Raise a non-conformance
POST  /v1/projects/:projectId/quality/ncrs/:ncrId/close
      Close a non-conformance with a disposition and a justification
POST  /v1/projects/:projectId/quality/snags/:snagId/close
      Close a snag with photographic evidence
POST  /v1/projects/:projectId/cdm/documents
      Draft a project-specific CDM document, naming any section it could not fill
POST  /v1/projects/:projectId/cdm/documents/:documentId/approve
      Approve a CDM document — refused while a required section is unfilled

Errors

RFC 7807 application/problem+json, with per-field detail where a schema rejected the body. Every response carries x-correlation-id and x-trace-id, and a command accepts an Idempotency-Key so a retried request returns the original result rather than performing the state change twice.

{
  "type": "https://construx.ai/problems/access-denied",
  "title": "ACCESS_DENIED",
  "status": 403,
  "detail": "No role of PM holds \"C\" on PROJECT_SETUP",
  "traceId": "…",
  "correlationId": "…"
}

Authentication

Bearer access tokens with a short lifetime and rotating refresh tokens, behind an MFA challenge. A public route may begin an authentication and never complete one — an invariant with a test behind it, because a demonstration endpoint once returned a working session to anonymous callers.

Communication events

177 notification events across 15 categories, fanning out over email, in-app, SMS, push and WhatsApp. 27 of them are mandatory and override a recipient's preferences, because a person is entitled to be told their account was locked whatever they have muted.

What the API will not do

It will not tell you which project ids exist. An id that does not exist and one belonging to another tenancy both answer 200 with an empty list on the generic entity read — a 404 for unknown and a 403 for forbidden would together be an enumeration oracle. That behaviour is tested, so nobody "fixes" it.