Platform API

Session-authenticated routes under /api/platform.
Source: app_docs/api.md, app_docs/guide/api.md, app_docs/billing.md (billing table).

Organizations

Requires session. Creates organization + Membership with role OWNER for the current user.

Body (Zod): { name } (1–120 chars)

Slug auto-generated from name; collision retries with random suffix.

201: { organization: { id, name, slug, createdAt } }
401: unauthorized

Not implemented (as documented in api.md): list, get, patch, delete, invites, roles API.

Org create may accept optional planId for marketing deep-links (#/register?plan=starter).

Method	Path	Notes
`GET` / `POST`	`/api/platform/orgs/:orgId/projects`	List / create (read / write capability)

Session + project access. Groups documented in the product API summary:

Consent configuration, categories, purposes, notice, publish
Publishable keys create/list/revoke (Owner for create/revoke) — see SDK API key table
Receipts list (cursor pagination), export
Webhook get/put, regenerate secret (Owner), test
Publish evidence

Console routes (HashRouter):
#/:projectSlug/consent · …/versions · …/receipts · …/develop · …/settings

Method	Path	Notes
`GET`	`/api/platform/projects/:projectId/evidence/publish`	Publish evidence summaries
`GET`	`/api/platform/projects/:projectId/evidence/publish/:versionId`	Publish evidence package
`GET`	same `?format=…&download=1`	Export download

Session user inbox.

Method	Path	Notes
`GET`	`/api/platform/notifications`	List + `unreadCount`
`POST`	`/api/platform/notifications/:id/read`	Mark one read
`POST`	`/api/platform/notifications/read-all`	Mark all read

In-app, poll-based operator alerts (bell). Not chat. Not push. Grouped by product (anumati, rights, systems, …) per concepts guide.

Method	Path	Notes
`GET`	`/api/platform/billing/plans`	Catalog (public)
`GET`	`/api/platform/orgs/:orgId/billing`	Plan + subscription + entitlements
`POST`	`/api/platform/orgs/:orgId/billing/trial`	`{ planId: starter\|growth }`
`POST`	`/api/platform/orgs/:orgId/billing/checkout`	`{ planId, interval }` → Razorpay or mock
`POST`	`/api/platform/orgs/:orgId/billing/cancel`	Cancel / downgrade
`POST`	`/api/platform/billing/webhooks/razorpay`	Public; signature required

Owner for org billing mutations. UI: #/billing.

Entitlements are limits from plan (projects, connectors, cases)—not hard-coded plan names inside feature logic.

Role	Can
Owner	All + billing, publishable keys, secret rotation
Admin	Read + write (projects, consent, rights, systems, maps)
Viewer	Read only

Non-members: 404. Wrong role: 403.