API
Conventions shared by every NTOMA endpoint — the response envelope, error shapes, pagination, and where the authoritative reference lives.
The API reference is generated from the backend’s live Swagger document and is the authoritative contract for every operation. These pages cover the conventions the reference does not express.
Conventions
Envelope, errors, pagination, scope.
Authentication
Token lifecycle, refresh rotation, OAuth exchange.
Organizations
Org scoping, roles, invitations.
Uploads
The three-step S3 multipart pipeline.
Workspace
Projects and tasks: board-position ordering, assignees, task-asset attachment.
Comments
Project and task comment threads, and the moderation rule both share.
Profile & dashboard
The signed-in user’s profile, avatar upload, and the Home summary.
Surface at a glance
84 routes are declared. 83 appear in the published spec — the seeder controller carries @ApiExcludeController(), so its one route is hidden from Swagger.
| Group | Routes | Guards |
|---|---|---|
| Auth | 14 | mostly open; GET /api/auth/user requires a bearer token |
| Profile | 4 | AuthGuard |
| Collections | 6 | AuthGuard + OrganizationGuard |
| Assets | 12 | AuthGuard + OrganizationGuard |
| Upload | 3 | AuthGuard + OrganizationGuard |
| Organizations | 11 | AuthGuard, plus OrganizationGuard and OrganizationRoleGuard on mutations |
| Projects | 6 | AuthGuard + OrganizationGuard |
| Project comments | 4 | AuthGuard + OrganizationGuard |
| Tasks | 10 | AuthGuard + OrganizationGuard |
| Task comments | 4 | AuthGuard + OrganizationGuard |
| Dashboard | 1 | AuthGuard + OrganizationGuard |
| Timeline | 6 | AuthGuard + RoleGuard; three are ADMIN-only |
| Plan | 1 | AuthGuard |
| Seeder | 1 | AuthGuard + RoleGuard, ADMIN |
| Health | 1 | open, outside the api prefix |