25 API and Route Handlers

25. API & Route Handlers Reference

Complete API endpoint directory, authentication protocols, and request/response contracts for PACT OS.

---

📡 API Endpoint Directory

All route handlers are located in src/app/api/:

Endpoint Route	HTTP Method	Auth Requirement	Purpose
/api/cron/sweep-deadlines	GET / POST	Bearer CRON_SECRET	Automated deadline sweeper cron job
/api/health	GET	Public	System status check & basic database ping
/api/health/deep	GET	Authenticated	Deep diagnostics (migrations, RLS policies, tables)
/api/user/export	GET	Session Cookie	Generates sanitized account data ZIP export
/api/notifications/dispatch	POST	Service Role / Auth	Dispatches queued notifications to user channels
/api/sync/delta	POST	Session Cookie	Offline multi-device sync replication delta handler
/api/finance/webhook	POST	Webhook Signature	External financial transaction webhook ingestion
/auth/callback	GET	OAuth Code	Supabase Auth PKCE code exchange handler

---

🔒 Cron Security Protocol (/api/cron/sweep-deadlines)

• Timing-Safe Auth: Expects Authorization: Bearer <CRON_SECRET> header.
• Constant-Time Comparison: Header token is compared using timing-safe string comparison to prevent side-channel timing attacks.
• Execution Log: Sweeper updates expired task states to missed and returns JSON summary (sweptCommitmentsCount, activatedConsequencesCount).