REST & OpenAPI
The generated HTTP surface, and where to browse the live reference.
For callers that aren't TypeScript, the same router is exposed as a REST API with a generated OpenAPI document.
The interactive reference
Every procedure carries REST metadata (method, path, tags, summary), and
oRPC's OpenAPI plugin turns it into a browsable, interactive reference served by
your own instance:
GET /v1 # interactive API reference (OpenAPI)Because it is generated from the router, it is always in sync with the running server — there is no separately maintained spec to fall behind.
The reference is the authoritative endpoint list for your version. The tables below illustrate
the shape; browse /v1 on your instance for the complete, current surface.
Example: the pages resource
A representative slice of the generated REST surface (tag: Pages):
| Method | Path | Summary |
|---|---|---|
GET | /pages | List pages in a space |
POST | /pages | Create a page |
GET | /pages/{id} | Get a page |
PATCH | /pages/{id} | Update a page |
DELETE | /pages/{id} | Delete a page |
POST | /pages/{id}/publish | Publish a page |
POST | /pages/{id}/move | Move a page in the tree |
POST | /pages/{id}/archive | Archive a page |
POST | /pages/{id}/restore | Restore an archived page |
GET | /pages/{id}/revisions | List revisions |
POST | /pages/{id}/revisions/{version}/restore | Restore a revision |
GET | /pages/{id}/draft | Get the draft |
PUT | /pages/{pageId}/draft | Save the draft |
DELETE | /pages/{id}/draft | Delete the draft |
POST | /pages/{id}/collab-token | Mint a page-scoped collab token |
Other resources (spaces, comments, tags, attachments, activity,
search, …) follow the same conventions under their own tags.
Authentication
REST calls authenticate the same way as the app — via the Better Auth session
cookie (/api/auth/*). Authorization is identical to the RPC surface: the same
org-RBAC and space/page checks apply. See Permissions.
HTTP methods & CORS
The REST surface uses PATCH / PUT / DELETE. If you call the API from a
browser on another origin, ensure those methods are allowed — the server's CORS
config already permits them so that batched /rpc preflight succeeds.