> ## Documentation Index
> Fetch the complete documentation index at: https://docs.briksync.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Overview

> The BrikSync PropOS HTTP API — real endpoints, authentication, response format, and rate limits.

BrikSync PropOS exposes a set of HTTP endpoints for authentication, platform health, document access, and a small number of data operations. The vast majority of product capabilities — properties, tenants, leases, payments, maintenance, and more — are available through the web application and are not currently exposed as HTTP API endpoints.

<Note>
  A full programmatic REST API is on the roadmap for Business plan users. If you have an integration
  requirement today, contact us at [hello@errsol.com](mailto:hello@errsol.com).
</Note>

***

## Base URL

All HTTP routes are served from the main application origin under `/api`.

```
https://briksync.com/api
```

All endpoints accept and return **JSON** unless noted. HTTPS is required.

***

## OpenAPI and interactive docs

* OpenAPI JSON specification: `/api/docs`
* Interactive Swagger UI: `/api/docs/ui`

These endpoints reflect the live contract used for client generation and integration testing. No authentication is required to read the specification.

***

## Available HTTP endpoints

The following HTTP routes currently exist. All other product capabilities are available through the BrikSync web application, not as HTTP API endpoints.

| Route                          | Methods   | Auth required     | Description                                                                                                                                                                                         |
| ------------------------------ | --------- | ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `/api/health`                  | GET       | No                | Liveness probe. Returns `200` when the server is running.                                                                                                                                           |
| `/api/docs`                    | GET       | No                | Full OpenAPI 3.1.0 specification as JSON.                                                                                                                                                           |
| `/api/docs/ui`                 | GET       | No                | Interactive Swagger UI for API exploration. Not indexed by search engines.                                                                                                                          |
| `/api/auth/callback`           | GET       | No                | OAuth and email verification callback. Exchanges an authorization code for a session and redirects the user.                                                                                        |
| `/api/auth/signout`            | POST      | No                | Signs out the current user and redirects to the login page.                                                                                                                                         |
| `/api/leases`                  | POST      | Yes (session)     | Create a lease record.                                                                                                                                                                              |
| `/api/leases/move-out-report`  | GET       | Yes (session)     | Generate and download a PDF move-out report. Tenants can access their own report; Admins, Landlords, and Property Managers can access any report within their organisation.                         |
| `/api/payments/receipt`        | GET       | Yes (session)     | Generate and download a PDF receipt for a succeeded rent payment. Tenants can access their own receipts; Admins, Landlords, and Property Managers can access any receipt within their organisation. |
| `/api/gdpr/export/[requestId]` | GET       | Yes (session)     | Download a completed GDPR data export package. Available to the requesting user or an Admin.                                                                                                        |
| `/api/cron/reminders`          | GET, POST | Yes (cron secret) | Internal endpoint that sends scheduled rent reminders. Called by the platform cron scheduler — not for external use.                                                                                |

<Note>
  All other product capabilities — properties, units, tenants, leases (list/read), payments,
  maintenance, documents, analytics, inspections, vendors, and more — are available through the
  BrikSync web application. A programmatic API covering these resources is planned for a future
  release.
</Note>

***

## Response format

Response shapes vary by endpoint type.

### JSON endpoints

The lease-creation endpoint returns a `data` payload on success:

```json theme={null}
{
  "data": { ... }
}
```

**Error responses across all endpoints return a bare error object** — there is no `data` field on errors:

```json theme={null}
{
  "error": "Description of what went wrong."
}
```

### File-download endpoints

The move-out report (`/api/leases/move-out-report`), payment receipt (`/api/payments/receipt`), and GDPR export (`/api/gdpr/export/[requestId]`) return the file directly on success with a `Content-Disposition` header — not a JSON envelope. Parse the response body as a file, not as JSON.

***

## Error codes

| HTTP Status | Meaning                                                   |
| ----------- | --------------------------------------------------------- |
| `200`       | Success                                                   |
| `201`       | Resource created successfully                             |
| `302`       | Redirect — used by auth callback and sign-out             |
| `400`       | Bad request — check your request parameters               |
| `401`       | Unauthorised — missing or expired session                 |
| `403`       | Forbidden — your plan or role does not permit this action |
| `404`       | Not found — the resource does not exist                   |
| `429`       | Too many requests — rate limit exceeded                   |
| `500`       | Server error — contact support if this persists           |

***

## Rate limits

To ensure fair use and platform stability, API requests are rate limited.

| Scope              | Rate limit                             |
| ------------------ | -------------------------------------- |
| General API        | 100 requests per minute per user or IP |
| Auth (sign-in)     | 5 attempts per minute per IP           |
| Registration       | 5 attempts per minute per IP           |
| Password reset     | 3 requests per minute per IP           |
| Email verification | 3 requests per minute per IP           |

If you exceed the rate limit, you will receive a `429 Too Many Requests` response with a `Retry-After` header indicating when you can retry.

***

## Authentication

The API uses browser session authentication. When you sign in to the BrikSync web application, a session is issued and managed automatically. HTTP endpoints that require authentication validate the active session on each request.

See the [API Authentication guide](/api/authentication) for details.

***

## Support

If you encounter issues, contact the BrikSync support team at [briksync.com/contact](https://briksync.com/contact) or email [hello@errsol.com](mailto:hello@errsol.com).

***

Built by [Errsol Technologies LLP](https://errsol.com)