# HTTP API

Send versioned operation envelopes to the canonical API endpoint. Operation input validation comes from the shared contract registry.

## Endpoint

POST /api/v2/execute accepts one version 1 operation envelope. Set INDIELOGS_URL to the public site origin without an API path; the client appends /api/v2/execute. The response is wrapped in data, and failures use an error object with code and message. This public search example runs without a token:

```text
export INDIELOGS_URL="https://your-indielogs-origin"
curl -X POST "$INDIELOGS_URL/api/v2/execute" -H "Content-Type: application/json" -d '{"version":1,"operation":"search.public","input":{"q":"founder tools"}}'
```

## Authenticated read

Create a token in Settings → Tokens, then keep the secret in a protected environment variable. This private read requires projects:read:

```text
export INDIELOGS_TOKEN="<token copied from Settings → Tokens>"
curl -X POST "$INDIELOGS_URL/api/v2/execute" -H "Authorization: Bearer $INDIELOGS_TOKEN" -H "Content-Type: application/json" -d '{"version":1,"operation":"projects.list","input":{}}'
```

## Contract-first operations

Operation names and validation schemas live in packages/contracts/src/operations.ts. The HTTP adapter, MCP tools and CLI use that registry. The list below is generated from that source; it is not a separate schema catalog. Use the shared parser/client for full input validation.

## API availability

Operation access can be public, browser-session-only, bearer-scoped, conditional on an input, or protected by an operation-specific capability. Public operations and MCP-allowed operations are separate sets. The generated operation table reports registry access metadata, not provider configuration or entitlement state for a deployment.