Enterprise REST API

The ThinkFlyFlow API is a REST API returning JSON. All endpoints are namespaced under /api/v2.

Every response uses a consistent envelope:

{
  "success": true,
  "data": { "...": "payload" }
}

{
  "success": false,
  "error": "Human-readable message",
  "code": "machine_code"
}

Interactive schema (OpenAPI 3):
• Swagger UI — /api/v2/docs/
• OpenAPI JSON — /api/v2/schema/

Send Content-Type: application/json on all write requests. Uploads use multipart/form-data.

All endpoints except /auth/login/, /auth/signup/, and /health/ require a bearer token:

Authorization: Bearer <access_token_or_pat>

{
  "email": "you@example.com",
  "password": "••••••••"
}

{
  "success": true,
  "data": {
    "access": "eyJhbGciOi...",
    "refresh": "eyJhbGciOi...",
    "user": { "id": 7757, "email": "you@example.com", "user_type": "admin" }
  }
}

Token lifetimes. Access tokens are valid for 72 hours; refresh tokens for 30 days and are rotated on each refresh.

{ "refresh": "eyJhbGciOi..." }

Two-factor authentication is supported: /auth/2fa/setup/, /auth/2fa/verify/, /auth/2fa/disable/, /auth/2fa/status/.

For server-to-server and headless integrations, use a Personal Access Token. PATs are prefixed lj-, do not expire by default, and are scoped to the issuing user. Treat them like passwords.

{ "name": "ci-agent" }

{
  "success": true,
  "token": {
    "id": "…",
    "name": "ci-agent",
    "token": "lj-xxxxxxxxxxxxxxxxxxxxxxxx",
    "expires_at": null
  }
}

Use the token exactly like an access token in the Authorization header.

curl https://api.laureljar.com/api/v2/auth/me/ \
  -H "Authorization: Bearer lj-xxxxxxxxxxxxxxxxxxxxxxxx"

List endpoints are paginated (page-number style) with a default page size of 20. Pass page and page_size as query parameters.

GET /projects/?page=2&page_size=50

{
  "success": true,
  "data": {
    "count": 137,
    "next": "https://api.laureljar.com/api/v2/projects/?page=3&page_size=50",
    "previous": "https://api.laureljar.com/api/v2/projects/?page=1&page_size=50",
    "results": [ { "...": "item" } ]
  }
}

Follow next until it is null to page through a collection. Sort and filter parameters are documented per endpoint in the reference below.

Errors use standard HTTP status codes and the error envelope above.

Include the request id (returned in the X-Request-Id response header) when contacting support.

The API enforces per-account rate limits and an AI credit budget for AI-backed endpoints.

{
  "success": true,
  "data": { "remaining": 82, "limit": 100, "resets_at": "2026-09-12T00:00:00Z" }
}

Grouped by domain. Method and path are shown; parameters, bodies and full response schemas are available in the live Swagger UI linked above.

Auth

Workspaces

Projects, folders & files

AI & intelligence

Builder, notifications, dashboard

Integrations & webhooks

Prefer the command line? Use the ThinkFlyFlow CLI →

Register an HTTPS endpoint to receive event notifications. Webhooks are signed so you can verify authenticity, and failed deliveries are retried with exponential backoff.

{
  "url": "https://your-app.example.com/hooks/thinkflyflow",
  "events": ["file.created", "file.updated", "ai.completed"],
  "secret": "whsec_xxxxxxxx"
}

{
  "id": "evt_123",
  "type": "file.created",
  "created_at": "2026-09-11T13:45:00Z",
  "data": { "file_id": "…", "project_id": "…", "name": "report.pdf" }
}

Verify the X-ThinkFlyFlow-Signature header by computing an HMAC-SHA256 of the raw body with your secret and comparing in constant time. Respond 2xx within 10 seconds to acknowledge.

The following apply to enterprise agreements. Wording here is indicative and subject to the signed contract.

For onboarding, certification, and API credentials, contact support@laureljar.com.