Application API
The v1 API
The /api/v1 routes are the ones the FounderReply app itself calls, so they authenticate the way the app does: your signed-in session, not an API key. The table below carries the credential each route accepts, per row. For a script or an agent holding an fr_live_ key, the surface is the MCP endpoint.
- 90 routes across 13 areas
- 78 are session-only; 12 also take an fr_live_ bearer key
- Generated into the same OpenAPI document the live reference renders
90 routes · 12 accept a key · none of them outranks the approval queue
Auth model
Which credential each route accepts
5 facts, and they decide how you read the table below. The third is what a 401 means when you were certain you sent a valid key.
- Session
- 78 of the 90 routes read your Supabase session cookie and nothing else. They are the routes the FounderReply app itself calls, so they authenticate the way the app does.
- Bearer
- 12 routes — /api/v1/voice/mcpdial/numbers, /api/v1/voice/mcpdial/numbers/{id}, /api/v1/voice/mcpdial/numbers/available, /api/v1/voice/mcpdial/numbers/requirements, /api/v1/voice/mcpdial/verification/status, /api/v1/voice/mcpdial/verification/profile, /api/v1/voice/mcpdial/verification/addresses, /api/v1/voice/mcpdial/verification/addresses/{id}, /api/v1/voice/mcpdial/verification/documents, /api/v1/voice/mcpdial/verification/documents/{id}, /api/v1/brain and /api/v1/brain/proposals — try an fr_live_ key first and fall back to the session.
- No fallback
- On the other 78, the Authorization header is not read at all — the session helper takes no request argument. A key sent there is not rejected; it is never looked at, and the request returns 401 exactly as no credential would.
- Membership
- Every workspace-scoped route checks membership before it reads a row, and answers 403 when it fails. The auth step and the authorisation step are separate, and neither is skipped.
- Headless
- A key drives POST /api/mcp, which is key-authenticated by design and reaches the same product. That is the surface to build a script or an agent against.
This request fails — do not curl these with a key
curl -H "Authorization: Bearer fr_live_…" https://founderreply.com/api/v1/approvals
Returns 401. Not because the key is wrong — because that route never looks at the header. Every sample on this site that sends a bearer key sends it to POST /api/mcp or to a route the table below marks Key or session, and there are no others.
Routes
Every integration-facing v1 route
90 routes across 13 areas, grouped the way the tool registry is on /developers/mcp. The auth column repeats the model above, row by row, so you never have to infer it. Prefer to send real requests from the browser? Try the interactive reference.
| Route | Method | Auth | What it does |
|---|---|---|---|
| Workspaces & accounts | |||
| /api/v1/workspaces | GETPOST | Session | List the workspaces you belong to, or create one. |
| /api/v1/oauth/{platform}/start | GET | Session | Begin the OAuth connect flow for a platform account. |
| /api/v1/accounts?workspace_id= | GET | Session | The workspace’s connected brand accounts. Tokens are never returned. |
| /api/v1/accounts/{id} | GETDELETE | Session | Inspect or disconnect one account. |
| Persona & content | |||
| /api/v1/personas | GETPOST | Session | Read or set the brand persona / content strategy: from a preset (free) or generated by AI (3 credits). |
| /api/v1/personas/bootstrap | POST | Session | Draft the focus brief from a connected account’s own posts. |
| /api/v1/strategy/generate | POST | Session | Generate a content plan (and planned scheduled posts) from the persisted persona. |
| /api/v1/scheduled-posts | GET | Session | The planned content calendar. |
| /api/v1/scheduled-posts/{id} | PATCH | Session | Edit or re-status one planned post. |
| /api/v1/publish | POST | Session | Publish approved content to a connected account, or queue a brief for drafting. |
| /api/v1/draft/stream | POST | Session | Server-sent stream of a drafted reply/post, token by token, for a live-typing compose UI. |
| /api/v1/news/plan | POST | Session | Trigger news-driven post planning for a workspace. |
| Campaigns — the marketing manager | |||
| /api/v1/campaigns?workspace_id= | GETPOST | Session | List campaigns, or brief the manager: a paragraph of intent becomes a campaign spec and a dated plan. |
| /api/v1/campaigns/{id} | GETPATCH | Session | One campaign with its plan and revision history; start, pause, rename or rebudget it. |
| /api/v1/campaigns/{id}/recompile | POST | Session | Re-plan the campaign’s future slots from its current spec. Never touches what already went out. |
| /api/v1/campaigns/{id}/review | POST | Session | Run the review now: reweight pillars/formats/hours from observed outcomes and record why. |
| /api/v1/campaigns/{id}/ask | POST | Session | Ask the manager about this campaign, grounded in its real numbers. Read-only. |
| /api/v1/campaigns/{id}/performance | GET | Session | Engagement rollup scoped to one campaign. |
| Approvals & inbox | |||
| /api/v1/approvals | GET | Session | The human-in-the-loop queue for social drafts. |
| /api/v1/approvals/{id} | POST | Session | Approve, edit, or skip one queued item. |
| /api/v1/inbox | GET | Session | Mentions and DMs pulled from the connected accounts. |
| Autonomy & analytics | |||
| /api/v1/autonomy | GETPUT | Session | Read or set the per-action autonomy level. Applied as written at decision time. |
| /api/v1/analytics/overview | GET | Session | Engagement and audience rolled up by pillar, platform, format, account, campaign and hour. Every bucket carries posts and measured — take rates over measured. |
| /api/v1/usage/summary | GET | Session | Credit and usage-counter summary for the workspace’s billing period. |
| Growth | |||
| /api/v1/growth/discover | POST | Session | Run opportunity discovery across the connected platforms. |
| /api/v1/engagement/standing?workspace_id= | GET | Session | Per-account engagement health: warm-up progress, today’s per-action budgets vs usage, community value:promo standing, and relationship tiers. The same numbers the gates check. |
| /api/v1/engagement/relationships?workspace_id= | GET | Session | Who has been engaged and where each sits on the permission ladder. ‘acknowledged’ means they replied — the only tier a DM may be sent to. |
| /api/v1/engagement/relationships/{id} | PATCH | Session | Record that someone asked to be left alone. Terminal: every engagement gate refuses them afterwards. |
| /api/v1/engagement/playbook?workspace_id= | GET | Session | Per-platform research: cadence band, best audience-local hours, format rotation, link cost, signal weights, community ratio, warm-up length and daily action ceilings. |
| /api/v1/growth/opportunities | GET | Session | The discovered engagement opportunities. |
| /api/v1/growth/opportunities/{id}/act | POST | Session | Act on one — through the approval queue, not around it. |
| Outreach & leads — cold email + voice | |||
| /api/v1/leads | GETPOST | Session | List the workspace’s leads, or create one. |
| /api/v1/leads/{id} | GETPATCH | Session | One lead’s cross-channel timeline; update status or consent. |
| /api/v1/leads/ingest | POST | Session | Ingest a prior conversation (+ optional docs) as JSON into the lead timeline and brain memory. |
| /api/v1/sequences | GETPOST | Session | List or create a multi-step, multi-channel outreach sequence. |
| /api/v1/sequences/{id}/enroll | POST | Session | Enroll a lead in a sequence. |
| /api/v1/outreach/send | POST | Session | Send an outbound email to a lead — verbatim body, or a goal to compose from. |
| /api/v1/outreach/approvals | GET | Session | Pending outreach reply drafts — the parallel queue for email/call/sms. |
| /api/v1/outreach/approvals/{id} | POST | Session | Approve or reject one drafted reply; approving sends it. |
| /api/v1/outreach/aup | GETPOST | Session | Read the current Acceptable Use Policy version, or accept it (owner/admin, recorded with IP + user-agent). |
| /api/v1/outreach/policy | GETPUT | Session | Read or set the calling / eligibility / kill-switch compliance policies. |
| /api/v1/outreach/status | GETPOST | Session | Kill-switch status, or resume sending after a compliance hold. |
| /api/v1/suppressions | GETPOSTDELETE | Session | The workspace’s opt-out list — add or remove a manual suppression. |
| /api/v1/calls/start | POST | Session | Place an outbound voice call to a lead. Triggers the LiveKit voice service; the transcript arrives by webhook. |
| /api/v1/telephony | GETPOST | Session | This workspace’s phone numbers + caller ID, or provision a new local number (owner/admin). |
| Phone numbers & verification — owner/admin | |||
| /api/v1/voice/mcpdial/numbers?workspace_id= | GETPOST | Key or session | The workspace’s phone numbers (status, country, type, credits/month), or buy one — spends credits; idempotency_key required. A carrier-verified number is pending until approved. |
| /api/v1/voice/mcpdial/numbers/{id}?workspace_id= | DELETE | Key or session | Release a number. Irreversible. |
| /api/v1/voice/mcpdial/numbers/available?workspace_id=&country=&type= | GET | Key or session | Numbers you can buy, with the monthly price and what the carrier still needs. |
| /api/v1/voice/mcpdial/numbers/requirements?workspace_id=&country=&type= | GET | Key or session | What a country’s carriers verify (fields, address rule, documents) and where the workspace stands. |
| /api/v1/voice/mcpdial/verification/status?workspace_id= | GET | Key or session | Carrier review per country/type: draft, in review, approved or rejected (with the reason). |
| /api/v1/voice/mcpdial/verification/profile?workspace_id= | GETPUT | Key or session | Who is behind the numbers — a business or an individual, with the legal fields. |
| /api/v1/voice/mcpdial/verification/addresses?workspace_id= | GETPOST | Key or session | Verification addresses (one per country). |
| /api/v1/voice/mcpdial/verification/addresses/{id}?workspace_id= | DELETE | Key or session | Delete an address. |
| /api/v1/voice/mcpdial/verification/documents?workspace_id= | GETPOST | Key or session | Uploaded documents (name and kind), or upload one: the raw PDF/JPG/PNG body, ?kind=&file_name=, up to 5 MB. |
| /api/v1/voice/mcpdial/verification/documents/{id}?workspace_id= | DELETE | Key or session | Delete a document. |
| Browser — real-browser automation | |||
| /api/v1/browser/run | POST | Session | Drive a goal on a page until a success condition holds. |
| /api/v1/browser/run/resume | POST | Session | Continue a run that parked on a verification step. |
| /api/v1/browser/scrape | POST | Session | Read a page in a real browser — structured fields, or markdown. |
| /api/v1/browser/screenshot | POST | Session | Capture a page as a base64 image, including logged-in pages. |
| /api/v1/browser/connections | GETPOST | Session | Sites this workspace has a browser session for, and connect-flow status. |
| /api/v1/browser/connections/{id} | POSTDELETE | Session | Re-poll one connection after a sign-in, or disconnect it. |
| /api/v1/browser/credentials | GETPOST | Session | Which stored credential names / IMAP inboxes exist. Never returns values. |
| Bots — Tier-B browser automation | |||
| /api/v1/bots/approvals | GETPOST | Session | The Tier-B bot approval queue: comments on strangers’ posts, replies, DMs, publishes. |
| /api/v1/bots/connect | POST | Session | Provision a Tier-B bot identity (browser-automation, not an official API). |
| /api/v1/bots/verify | GETPOST | Session | Compile and verify a bot skill against a test account before it goes live. |
| SEO | |||
| /api/v1/seo/sites | GETPOST | Session | List and register the sites tracked for SEO. |
| /api/v1/seo/sites/{id} | PATCH | Session | Configure a site’s blog mount URL and IndexNow key. |
| /api/v1/seo/audit | POST | Session | Run the on-page audit sweep and reconcile the issue register. |
| /api/v1/seo/overview | GET | Session | Site and page counts, average score, open issues by severity, keyword coverage. |
| /api/v1/seo/issues | GET | Session | Open on-page issues across the workspace’s sites. |
| /api/v1/seo/pages | GET | Session | Inventoried pages with their latest audit score/status. |
| /api/v1/seo/rankings | GET | Session | Latest SERP position per tracked keyword. |
| /api/v1/seo/keywords | GETPOST | Session | The tracked keyword portfolio; add or update one. |
| /api/v1/seo/content-gaps | POST | Session | Find under-ranking keywords, read who outranks you, and generate articles against the gap. |
| /api/v1/seo/gsc/sync | POST | Session | Ingest Google Search Console’s real impressions/clicks/average position. |
| /api/v1/seo/review | POST | Session | Run the LLM qualitative review for one inventoried page. |
| Blog | |||
| /api/v1/blog | GET | Session | The workspace’s generated blog articles. |
| /api/v1/blog/{id} | GETPATCH | Session | One article, or update its status/body. |
| /api/v1/blog/generate | POST | Session | Generate a batch of finished articles. |
| /api/v1/blog/conquest | POST | Session | Mine a competitor’s surface and generate posts capturing the traffic it ranks for. |
| /api/v1/blog/refresh | POST | Session | Redraft published articles in place — same slug, honest updated_at. |
| /api/v1/blog/syndication-targets | GETPOST | Session | List, or connect, Medium/Dev.to/Hashnode/Ghost cross-posting credentials. |
| /api/v1/blog/syndication-targets/{platform} | PATCHDELETE | Session | Pause/resume, or disconnect, one syndication platform. |
| /api/v1/blog/{id}/syndicate | GETPOST | Session | Per-platform syndication state for an article, or (re)publish it to every connected target now. |
| /api/v1/publications | GET | Session | Publications for one account, newest-first. |
| /api/v1/images | POST | Session | AI image generation. Pro plan only, metered at 5 credits. |
| Keys & brain | |||
| /api/v1/api-keys | GETPOST | Session | List and mint fr_live_ keys. The plaintext is shown exactly once. |
| /api/v1/api-keys/{id} | DELETE | Session | Revoke one key. |
| /api/v1/brain | POST | Key or session | Ask the workspace’s brain. Tries a bearer key first, falls back to the session. |
| /api/v1/brain/proposals | GETPOST | Key or session | Read and resolve review-gated proposals from that brain. |
Session means the Supabase cookie your browser already holds, set when you signed in. Key or session means the route reads Authorization: Bearer fr_live_… first and falls back to that cookie. There is no third case: a route marked Session ignores the Authorization header entirely.
Guardrails
Signed in is not the same as approved
Authenticating a v1 request buys you the same standing the dashboard has, and no more. A route that would publish writes to the queue the dashboard reads from, under the autonomy mode you set for that action on that network.
A v1 request, in full
Enforced in the route handlers themselves — not by a client library you could swap out.
Always
Authenticate before the handler runs — a key on /api/v1/voice/mcpdial/numbers, /api/v1/voice/mcpdial/numbers/{id}, /api/v1/voice/mcpdial/numbers/available, /api/v1/voice/mcpdial/numbers/requirements, /api/v1/voice/mcpdial/verification/status, /api/v1/voice/mcpdial/verification/profile, /api/v1/voice/mcpdial/verification/addresses, /api/v1/voice/mcpdial/verification/addresses/{id}, /api/v1/voice/mcpdial/verification/documents, /api/v1/voice/mcpdial/verification/documents/{id}, /api/v1/brain and /api/v1/brain/proposals, your session cookie on the other 78
Check workspace membership before reading or writing a row, and answer 403 when it fails
Send a publish to the same approval queue the dashboard reads from
Apply the autonomy mode set for that action on that network, whatever made the call
Never
Read the Authorization header on the 78 session-only routes — it is ignored, not rejected
Publish sooner because the caller was a script, a cron or a tab you opened yourself
Return a row from a workspace you are not a member of
Move a dial for you — raising one is your decision, and it is written to the audit log
Two surfaces, one product
Signed in, these 90 routes. Headless, one endpoint.
The v1 routes run on the session you already have. For a script or an agent, mint an fr_live_ key and drive the MCP endpoint — same workspace, same controller in front of every write.
Free to start · Approval on by default · No card required