Private AI reports

Generate a report

POST /api/v2/reports/generate is an alias for the shared reports.generate operation. Supported kinds are idea, bmc and marketing. The request is validated by the canonical schema in packages/contracts/src/reports.ts; required inputs depend on the selected kind. The response contains the report and a report_access_token.

curl -X POST "$INDIELOGS_URL/api/v2/reports/generate" \
  -H "Content-Type: application/json" \
  -d '{"kind":"idea","targetMarket":"Independent software founders","ideaDescription":"A tool that turns shipping evidence into a public journal."}'

Read and protect a report

The generated report is private. Its report_access_token is a bearer capability bound to that report and expires after 90 days. Treat it like a password: do not put it in a URL, public post, analytics event or shared log. Generate the report again if the capability expires.

For the operation API, reports.read takes kind, id and report_access_token in the normalized execute input. The legacy GET /api/v2/reports/:kind/:id route accepts X-Report-Access-Token. A browser form stores the capability in an HttpOnly cookie and does not return it in JSON. The capability is not an account API key and grants access only to its report.

curl "$INDIELOGS_URL/api/v2/reports/idea/REPORT_ID" \
  -H "X-Report-Access-Token: $REPORT_ACCESS_TOKEN"

CLI and MCP

reports.generate and reports.read are present in the shared operation registry and exposed through the CLI and MCP definitions. MCP still requires its authenticated, entitled connection and scoped API token. CLI console output redacts credentials; use --output FILE only when you need to retain the raw response. The CLI creates that file with mode 0600 and refuses to overwrite an existing file, so protect and delete it when no longer needed.

• Do not paste a report access token into a command that may be saved in shell history.
• Do not send the capability to an agent unless it needs to read this specific report.
• The CLI currently ships in the repository; these instructions do not imply a public npm release.

AI Gateway prerequisites

Generation uses the configured AI Gateway and fails closed when required configuration is missing. The deployment operator must configure AI_GATEWAY_API_KEY, AI_REPORT_MODEL and the relevant explicit AUTOPILOT_WRITER_MODEL, AUTOPILOT_HISTORY_MODEL, AUTOPILOT_CLASSIFIER_MODEL and AUTOPILOT_EMBEDDING_MODEL identifiers. Model IDs must be available to that gateway account; configuration alone does not prove provider acceptance. Direct provider API keys are not used as a fallback. OUTBOUND_ENABLED and the applicable generation budget also apply.