API reference

All endpoints are served under https://esb.guru. Responses are JSON. Paths with :id (or :carrierId, :key) are parameterized. Every mutating call (POST / PUT / PATCH / DELETE) under /api/* is recorded in the audit log; pass an optional x-actor header to attribute it.

Most routes run in the data Durable Object (the shared Hono app). A handful — search, ai-brief, and admin/* — are handled by the front-door Worker because they touch Vectorize, R2, or run before the Access gate.

Metrics & snapshot

Method	Path	Purpose
GET	/api/metrics	Dashboard rollups — open/our/carrier/overdue counts, open RCV, avg rounds.
GET	/api/snapshot	Full live read-model in one call (details for every estimate).
GET	/healthz	Liveness check (public — no Access gate).

Estimates

Method	Path	Purpose
GET	/api/estimates	List estimates (the worklist), each with carrier, aging, open-follow-up count.
POST	/api/estimates	Create an estimate (estimateNo, carrierId, insuredName required).
GET	/api/estimates/:id	Fetch one estimate — header, carrier, revisions, line items, follow-ups, events, aging.
POST	/api/estimates/:id/submit	Submit / resubmit to the carrier (ball → carrier).
POST	/api/estimates/:id/revision	Log a carrier revision (note required) — parses + fires rules (ball → us).
POST	/api/estimates/:id/approve	Mark approved / settled (ball → done).
POST	/api/estimates/:id/line-items	Add a line item (code, description, rcv, itemStatus, roundIntroduced).
POST	/api/estimates/:id/followups	Add a follow-up (title, kind, owner, dueAt, note).

Follow-ups

Method	Path	Purpose
GET	/api/followups	List all follow-ups (the estimator queue) with estimate + carrier context.
POST	/api/followups/:id/complete	Complete a follow-up.

Emails & correspondence

Method	Path	Purpose
GET	/api/emails	List ingested emails (optional ?status=).
GET	/api/emails/:id	Fetch one email.
GET	/api/estimates/:id/emails	Correspondence attached to an estimate.
POST	/api/emails/:id/attach	Attach an email to an estimate (estimateId or estimateNo).
POST	/api/emails/:id/ignore	Mark an email ignored (triage).

Carriers & estimators

Method	Path	Purpose
GET	/api/carriers	List carriers with rollup stats (open / total).
POST · PATCH · DELETE	/api/carriers · /api/carriers/:id	Create / update / delete a carrier.
GET	/api/carriers/:carrierId/rules	Rules for a carrier.
POST · PATCH · DELETE	/api/carrier-rules · /api/carrier-rules/:id	Create / update / delete a rule.
POST	/api/carriers/:carrierId/rules/preview	Dry-run a rule set against a sample context.
GET · POST	/api/estimators · /api/estimators/:id	List / get / create estimators.
PATCH · DELETE	/api/estimators/:id	Update / delete an estimator.

AI & search

Method	Path	Purpose
GET	/api/ai/config	Current model + prompts, defaults, and env overrides.
POST	/api/ai/parse-revision	Parse an auditor note (note) → reason codes + disputed items.
POST	/api/ai/next-best-action/:id	Compute a brief for an estimate.
GET	/api/ai-brief/:id	Read the persisted next-best-action brief (from R2).
POST	/api/ai-brief/:id	Recompute + persist the brief (to R2).
GET · POST	/api/search	Semantic search (?q= or body { q }) — Workers AI + Vectorize, KV-cached.

See AI for how these are used.

Configuration

All configuration lives in-app with a matching API. See Configuration.

Method	Path	Purpose
GET	/api/settings · PUT /api/settings/:key	App settings (incl. aiConfig, outboundWebhookUrl, statusMap).
GET · POST · PATCH · DELETE	/api/app-registrations · /:id	Entra / Graph app registrations.
POST	/api/app-registrations/:id/validate	Validate a registration’s credentials.
GET · POST · PATCH · DELETE	/api/email-accounts · /:id	Mailboxes.
GET · POST · PATCH · DELETE	/api/domains · /:id	Sender domains.
GET · POST · PATCH · DELETE	/api/subject-rules · /:id	Subject-line routing rules.
GET · POST · PATCH · DELETE	/api/filters · /:id	Ingestion / saved filters (?scope=).
GET · POST	/api/sla-policies	SLA timers (global + per-carrier).
GET · POST	/api/phases	Phase multipliers.

Audit

Method	Path	Purpose
GET	/api/audit	Append-only trail of every mutation + admin clear/load (?limit=, newest first).

See Audit log for the schema and how entries are produced.

Webhooks

Method	Path	Purpose
GET	/api/webhooks/status	Discovery — live schema + status map (no auth).
POST	/api/webhooks/status	Push a status in (requires x-webhook-token).
POST	/api/webhooks/test	Echo test for connection setup.
GET	/api/webhooks/xactanalysis	Discovery — XactAnalysis event schema (no auth).
POST	/api/webhooks/xactanalysis	XactAnalysis lifecycle sync — assignment · revision · submitted · approved · settled · status.

See Webhooks & integrations for auth, payloads, and the status map.

Admin (data loading)

Guarded by Authorization: Bearer <REVSRC_SECRET_KEY> and handled at the Worker edge, before the Access gate. CLI / automation only — there is no admin UI.

Method	Path	Purpose
POST	/api/admin/clear	Empty every table in the Durable Object (FK-safe order).
POST	/api/admin/load	Clear, then bulk-load a dataset in FK order. Returns per-table counts.
POST	/api/admin/seed	Reseed the built-in demo generator (dev convenience).
POST	/api/admin/reindex	Re-embed every estimate into Vectorize. Returns { indexed }.

See Data loading for the workflow.