API Layer
// Where it lives
All HTTP communication goes through lib/api.ts. The module exposes a single low-level helper (apiFetch), a JSON-aware wrapper (apiCall) and four convenience methods bound to the common verbs.
// Layers
apiFetch(path, options) // raw Response
└─ apiCall<T>(...) // parses JSON, normalises errors
├─ apiGet<T>(path)
├─ apiPost<T>(path, body)
├─ apiPut<T>(path, body)
└─ apiDelete<T>(path)// Calling endpoints
Every helper is fully typed via a generic. You give it the response shape, the helper returns a typed object — or throws an ApiError on failure.
const apps = await apiGet<Application[]>("/api/applications");
const created = await apiPost<License>("/api/licenses", {
applicationName: "demo",
name: "Pro - Customer #42",
type: "Pro",
durationDays: 30,
hwidBound: true,
});// ApiError
Non-2xx responses are normalised. Every error includes:
- STATUSThe HTTP status code.
- CODEAn optional machine-readable code from the backend, if returned.
- MSGA user-readable message — either from the backend body or a default mapped by status code (see Errors).
- DATAThe original response payload for advanced handling.
// Endpoints used by the dashboard
The list below reflects what the dashboard actually calls. The authoritative reference is the backend itself; this is a quick map of the integration surface.
- GET /api/auth/check-session
- GET /api/auth/logout
- GET /api/userdata
- GET /api/applications
- GET /api/invites
- GET /api/apps/<name>
- POST /api/apps
- PUT /api/apps/rename
- DELETE /api/apps/delete
- GET /api/licenses/<name>
- POST /api/licenses
- PUT /api/licenses/duration
- DELETE /api/licenses/delete
- GET /api/users/<name>
- DELETE /api/users/delete
- GET /api/variables/<name>
- POST /api/variables
- PUT /api/variables
- DELETE /api/variables/delete
- GET /api/team/<name>/members
- GET /api/team/<name>/invites
- POST /api/team/<name>/invite
- DELETE /api/team/<name>/kick
- PUT /api/team/<name>/permissions
- POST /api/team/<name>/transfer
- GET /api/logs/<name>
- DELETE /api/logs/clear
- GET /api/secrets/<name>
- POST /api/secrets/rotate
- GET /api/security/<name>
- GET /api/discover/<name>
- PUT /api/discover/<name>
- GET /api/boosts/<name>
- GET /api/boosts/history
- POST /api/libs/generate
- POST /api/stripe/portal
- POST /api/2fa/setup
- POST /api/2fa/disable