Admin endpoints

Dashboard-only. Send X-OpenRoadmap-Session from POST /v1/auth/login. Demo auth is magic-link style without an external IdP.

POST/v1/auth/loginpublic

body · json

{ "email": "admin@acme.test" }

Returns token, user, organization, and default project.

GET/v1/mesession

Current user + org + projects.

GET/v1/statssession

Home metrics. Optional ?projectId=.

GET/v1/inboxsession

Open submissions. ?type=all|feature|bug|question|general.

POST/v1/featuressession

convert · json

{ "submissionId": "<uuid>", "title": "Optional title" }

POST/v1/features/:id/mergesession

merge · json

{ "submissionId": "<uuid>" }

PATCH/v1/features/:id/statussession

status · json

{
  "status": "in_progress",
  "roadmapColumn": "now"
}

Statuses: new → under_review → planned → in_progress → shipped (+ declined, duplicate, archived). Notifies followers; portal link uses /feature/view/?slug=.

GET/v1/featuressession

GET/v1/features/:idsession

PATCH/v1/submissions/:id/archivesession

GET/v1/widget-settingssession

PATCH/v1/widget-settingssession

Partial update of greeting, mascot, capture flags, colors, position.

GET/v1/emails/outboxsession

Recent queued / sent mail (demo-friendly without Resend).

Warning

Production should replace demo login with your IdP and mint short-lived session tokens server-side. Do not expose service-role database keys to the browser.