Skip to main content
All routes except GET /api/public/overview and NextAuth callbacks require a valid NextAuth session cookie. The edge proxy returns 401 before the handler if the JWT is missing, inactive, or on the logout deny-list. Base URL (local): http://localhost:3000

​
Conventions

  • JSON request bodies unless noted (CSV/PDF/DOCX downloads).
  • Errors: { "error": "message" } with 400 / 401 / 403 / 404 / 409 / 429 / 500. Full catalog: Errors and rate limits.
  • Dynamic [id] params are MongoDB ObjectIds.
  • Super Admin checks should reload User.level from MongoDB on mutating admin APIs.
There is no API key. Browser and curl callers must send the session cookie from Google sign-in.

​
Route map

  • GET POST /api/auth/[...nextauth] — NextAuth (POST auth limited to 20 / 60s per IP)
  • GET /api/public/overview — unauthenticated district snapshot (Redis 60s)
  • GET /api/question-bank — published or JSON bank for the editor
  • GET POST PUT /api/school-year — year settings; POST/PUT Super Admin
Collection: GET POST /api/formsPer plan: GET PUT DELETE /api/forms/[id]Steps: GET PUT /api/forms/[id]/step/[stepNumber] · POST .../unlockYear-over-year: POST .../duplicate · GET .../compare · POST .../attest · POST .../review-flagPresence: GET .../locks · GET .../editors · POST .../editors/registerReview: POST .../comments (level 5) · PUT .../comments/[commentId] (action: read | fixed)Share / owner: POST GET DELETE /api/admin/forms/share · POST /api/forms/[id]/share (level 5 email share) · POST /api/forms/transfer-ownershipExport: GET .../export/pdf · GET .../export/docxDetails: Forms API.
Question bank, rollover, live override, year CSV, goals, reports, timeline, health — Admin API and System health.
GET PUT DELETE /api/users · POST /api/users/create · POST /api/users/bulk · POST /api/users/bulk-import · PUT /api/users/[id]/permissions · GET /api/users/audit-logsPlus GET /api/notifications (review pings for the plan owner).Details: Users API.

​
Public overview

​
string
July–June label from currentSchoolYear() (on 19 August 2026 this is 2026-2027).
​
string
Prior cycle (2025-2026).
​
number
Section count from the published bank or formQuestions.json.
​
number
Distinct schoolName values with a plan.
​
number
Plans whose schoolYear is the current cycle.
​
number
Counts submitted, under_review, and approved for the current year.