The same API the product runs on.
Primue doesn’t have a separate, external developer API with its own keys yet — what’s below is the real internal API the app itself calls. Every route is session-authenticated and scoped to your tenant server-side, so a request can never read or write another tenant’s data.
| Method | Endpoint | What it does |
|---|---|---|
| GET | /api/wallet | Returns your wallet accounts and recent transactions. |
| POST | /api/wallet/transfer | Records an outbound transfer and updates the balance. |
| POST | /api/sign | Hashes a document and signature, chains it to the previous signature, returns a certificate ID. |
| GET/POST | /api/stripe/payment-links | Lists or creates a real, live Stripe payment link on your connected account. |
| POST | /api/stripe/webhook | Receives Stripe events, verifies the signature, credits your wallet on a completed checkout. |
| GET/POST | /api/documents | Lists or saves a document tied to your tenant, for use in white-label mini sites. |
| POST | /api/assistant | Sends a prompt to Claude and returns a structured draft document. |
How authentication works
Requests carry a Supabase session cookie set at sign-in. Every route resolves the caller’s tenant from that session server-side — a client can never pass a tenant ID and have it trusted. Webhook endpoints (like Stripe’s) skip session auth entirely and instead verify a cryptographic signature on the payload before touching the database.
Public API keys — on the roadmap
A proper external API — scoped API keys, rate limits, published request/response schemas — isn’t built yet. If programmatic access to your own data would unblock something you’re building, tell us what you need.
Talk to us about API access