REST conventions

Base URL: https://api.tefily.com. JSON request bodies. Unless noted, successful responses look like:

{ "success": true, "data": { } }

Errors look like:

{ "success": false, "message": "..." }

Validation failures may include an errors object. The SDKs throw KataflaxException with statusCode, message, and optional errors.

Authorization

Authorization: Bearer <token>

Token	Data API /api/p/...	Console /api/...
Platform JWT	Yes, bypasses rules	Yes
PAT kfx_…	Yes, bypasses rules	Yes
Service token kfxs_…	Yes, bypasses rules	No
Project JWT	Yes, subject to rules	No

CORS

The public data API reflects the caller Origin, so browser apps on any site can call /api/p/.... Console routes use a server allowlist (CORS_ALLOWED_ORIGINS).

Git Smart HTTP

Clone/push is not under /api. It lives at /git/:projectId/:repoSlug/.... See Git.