# API reference

All application routes are under `/api`. OpenAPI is mapped in Development only. The authoritative contracts are the controller request/response types and tests in `JobTrackerApi.Tests/`.

| Area | Main routes |
|---|---|
| Authentication | `/auth/config`, `/auth/login`, `/auth/register`, `/auth/me`, password/email verification and reset |
| Jobs/applications | `/jobapplications` CRUD, board, pipeline, reminders, history, timeline, stats, follow-ups, soft-delete/restore, AI workspace |
| Companies | `/companies` CRUD and recruiter/pipeline context |
| Correspondence | `/correspondence` per-application messages and inbox views |
| Gmail/Graph/IMAP | `/gmail`, `/microsoft-graph`, `/imap` connect, sync, review, and relink flows |
| Attachments | `/attachments` validated upload, list, download, metadata rename, delete |
| Career/CV | `/profile-cv` extraction, structure, rewriting, tailoring, templates, export |
| Rules/exports/backups | `/rules`, `/export`, `/backup` |
| Admin | `/users`, `/admin/audit`, `/admin/system` |
| Billing | `/billing` hosted checkout, portal, and webhook when configured |

Mutating requests using a session cookie require the CSRF double-submit header. Authorization and owner filtering are enforced in the API; a UI route is not a security boundary. See [authentication](../security/authentication.md) and [authorization](../security/authorization.md).