Developer docs and API reference

Overview

Every endpoint is served by the site itself under /api. There are three groups:

• Public APIs need no sign in: the partner directory, listing claims and password reset.
• Portal APIs power the partner and client portals. They need a signed in portal session and act only on the signed in organisation.
• AI Studio API is a published draft. It is not live yet; the shape may still change before release.

Requests and responses

• Send JSON with Content-Type: application/json. Uploads use multipart/form-data with a single file field.
• Responses are JSON with camelCase names. Portal and claim responses carry a success flag.
• A request that is understood but refused, such as a wrong password, returns 200 with "success": false and an error message. Check the flag, not only the status code.
• Missing sign in returns 401, missing admin rights 403, an unknown record 404, malformed JSON 400.
• Dates are returned as display strings, for example "Oct 29, 2026" or "2026-10-29", not ISO timestamps.

// refused but understood
{ "success": false, "error": "Invalid email or password." }

Authentication

Portal APIs use a secure, HTTP only session cookie that the browser keeps after a successful sign in. Sessions end after 8 hours without activity, and changing a password signs out every other session for that user.

1. Call POST /api/partner/portal/login or POST /api/client/portal/login with email and password.
2. Send later requests from the same browser session. The cookie is sent automatically on the same site.
3. Call /logout to end the session.

The portal APIs are designed for the portal pages on the same site. They do not send cross origin headers, so call them from your own server side code or from pages on the same domain.

Partner directory Public

Search and read the public partner listings. Only partners that are active and visible are returned.

Press Send to see a response.

Partner listing claims Public

Password reset Public

The same three steps exist for both portals: replace partner/portal with client/portal for the client portal.

Links are valid for 60 minutes and work once.

Partner portal Session

Base path /api/partner/portal. Reads are open to every user of the partner; changes to the profile, users, offices and projects need a partner admin.

Images (logo, project image, website screenshot) accept JPG, PNG and WebP up to 5 MB. A deactivated partner can still sign in and read, but every change returns 403 with "partnerDeactivated": true.

Client portal Session

Base path /api/client/portal.

AI Studio API Draft, not live

This is the planned interface for sending work to AI Studio from your own tools, such as a ticket system or a design tool. It is published early so you can plan; nothing here is callable yet, and names may change before release.

Authentication will use API keys created in the back office, sent as Authorization: Bearer <key>, each tied to a back office user and their roles.

curl -X POST https://<your-site>/api/ai-studio/v1/tasks \
  -H "Authorization: Bearer $IBN_KEY" \
  -H "Content-Type: application/json" \
  -d '{"request":"Add a plan comparison block to /pricing","attachments":["att_7Q2"]}'

using var http = new HttpClient { BaseAddress = new Uri("https://your-site/") };
http.DefaultRequestHeaders.Authorization = new("Bearer", key);
var res = await http.PostAsJsonAsync("api/ai-studio/v1/tasks", new {
    request = "Add a plan comparison block to /pricing",
    attachments = new[] { "att_7Q2" }
});
var task = await res.Content.ReadFromJsonAsync<TaskCreated>();

const res = await fetch("/api/ai-studio/v1/tasks", {
  method: "POST",
  headers: { Authorization: `Bearer ${key}`, "Content-Type": "application/json" },
  body: JSON.stringify({ request: "Add a plan comparison block to /pricing", attachments: ["att_7Q2"] })
});
const { id, status } = await res.json();

// GET /api/ai-studio/v1/tasks/task_51F  (draft shape)
{
  "id": "task_51F",
  "status": "awaiting_approval",      // queued, working, awaiting_approval, released, rejected, failed
  "branch": "ai-studio/plan-compare",
  "previewUrl": "https://staging.your-site/pricing",
  "files": [{ "path": "Views/Pricing/Index.cshtml", "added": 3, "removed": 19 }],
  "checks": [{ "name": "build", "result": "passed", "seconds": 41 }],
  "usage": { "tasksThisMonth": 38, "monthlyLimit": 400 }
}

Webhooks Draft, not live

AI Studio will post task events to an address you register: task.awaiting_approval, task.released, task.failed and release.rolled_back. Each delivery will carry an X-IBN-Signature header, an HMAC SHA-256 of the body with your webhook secret, so you can check it came from your installation.

Widgets and templates

The site is an ASP.NET Core 8 MVC application. Editors build pages from widgets, sections and page templates; developers add new ones as ordinary view components in the solution, and AI Studio creates them the same way.

1. Add a view component and its properties class under Components/Widgets/<Name>/.
2. Register it with a unique identifier so it appears in the page builder.
3. Put its view in Components/Widgets/<Name>/Default.cshtml and its styles in wwwroot/css/widgets/.
4. Build, then add it to a page in the back office.

A full walkthrough with a sample widget will be added here when the extension guide is published.