API Overview

lk-wiz exposes two APIs:

• a REST API over API Gateway (HTTP) for all CRUD and GenAI operations, and
• a WebSocket API over API Gateway (WebSocket) for real-time collaboration.

Base path & auth

All REST routes use the base path /api. Authentication is a Cognito JWT passed as:

Authorization: Bearer <access_token>

Every request (except the two exceptions below) is validated by a native API Gateway JWT authorizer (aws_apigatewayv2_authorizer, authorizer_type = "JWT", backed by the Cognito user pool) — not a Lambda authorizer. The authorizer only checks the token's signature, audience, and issuer; it does not check the custom:approved claim, so approval is not enforced at the API Gateway layer for the REST API (see aws_apigatewayv2_authorizer.lkwiz_jwt in app.tf). Handlers then enforce workspace-level RBAC on top of that. Two exceptions to JWT auth:

• POST /api/auth/callback — the Cognito OAuth callback (no auth; exchanges an auth code for tokens).
• POST /api/quick-capture — token-based idea capture using an X-Capture-Token header instead of a JWT.

Conventions

• Field casing — request and response bodies use snake_case. The frontend uses camelCase and converts at the HTTP boundary.
• List filtering — list endpoints accept camelCase query params such as workspaceId, status, and domain-specific filters (see each domain's own page).
• GenAI responses — generation and iteration are synchronous request/response; the full Bedrock output is returned in a single payload once complete. API Gateway HTTP does not support Lambda response streaming, so there's no incremental/streamed output today.

Domains

See the REST API page for the endpoint reference and the WebSocket API page for the real-time routes.