The API
The oRPC API surface: how it is exposed, the access-control tiers, and the routers.
The API is defined in @repo/api using oRPC and served through Hono, mounted in the saas
app at the catch-all route app/api/[[...rest]]. Clients call it through a typed oRPC client, so
inputs and outputs are end-to-end type-checked. The root router composes one sub-router per domain.
Exposure
The handler exposes both an OpenAPI/REST surface (base path /api) and an RPC surface (/api/rpc).
A shared middleware stack runs ahead of procedures: request identification, CORS, authentication, a
plan-tier backstop, the AI usage-cap check, organization-suspension gating, and locale resolution.
Access-control tiers
Procedures are built from a small set of base procedures that layer in access control:
| Tier | Guarantees | Used for |
|---|---|---|
| public | No auth. | Slug generation, health. |
| protected | Authenticated user + session. | Profile, notifications, home summary. |
| admin | Global admin role. | All operator and admin routers. |
| org-scoped | Membership in the target organization (and not suspended). | Advisor, policy, usage, org ingestion. |
| plan-gated | Org-scoped and the plan includes the feature. | Advisor (requireAdvisorPlan), Policy Hub (requirePolicyHubPlan), LP Reporting (requireReportingPlan). |
Routers
| Router | Purpose | Typical access |
|---|---|---|
admin | List users and organizations for the admin governance screens. | admin |
organizations | Slug generation, logo upload, profile updates. | mixed |
users | Avatar upload. | protected |
home | Cross-organization home summary. | protected |
notifications | List, counts, read state, preferences. | protected |
payments | Checkout links, customer portal, purchases. | protected / org owner |
advisor | Ask the advisor; list and read conversations. | org-scoped, advisor plan |
ai | Streaming responses and policy gap-review generation. | mixed |
usage | Per-organization run totals and recent usage. | org-scoped |
ingestion | Job listing, health, enqueue, retry. | mixed (admin for cross-tenant) |
policy | Policy Hub documents and gap reviews. | org-scoped, policy-hub plan |
reporting | The whole LP Reporting cycle (see below). | org-scoped, reporting plan + flag |
portfolioAccess | Portfolio-company access, including the messaging bridge. | mixed |
operator | Command Center tenant operations. | admin |
operatorIntelligence | Usage, conversation oversight, knowledge gaps. | admin |
Selected procedures
The procedures that back the documented features:
advisor
| Procedure | Type | Purpose |
|---|---|---|
ask | mutation | Run a grounded advisor turn (embed → retrieve → generate). |
listConversations | query | List the organization's advisor conversations. |
getConversation | query | Fetch a conversation with its messages and citations. |
policy
| Procedure | Type | Purpose |
|---|---|---|
list, get | query | Browse policy documents and their ingestion status. |
createUploadUrl, register, replace, delete, updateMeta | mutation | Manage policy documents (latest-wins replacement). |
downloadUrl | query | Presigned download link. |
gapReviewGet, gapReviewList, gapReviewExport | query/mutation | Retrieve and export policy gap analyses. |
ingestion
| Procedure | Type | Access | Purpose |
|---|---|---|---|
listJobs | query | org-scoped | Jobs for an organization (operators may include global). |
getHealth | query | org / admin | Health summary for an org or platform-wide. |
enqueueDoc | mutation | org admin | Enqueue ingestion for a document. |
listAllFailedJobs | query | admin | Failed jobs across all tenants. |
retryJob | mutation | admin | Retry a failed job. |
reporting
The largest router, grouped by the screen it serves:
| Group | Procedures |
|---|---|
lp | list, create, get, update, delete |
template | createUploadUrl, register, list, get, parse, uploadNewVersion, diffVersions, delete |
kpi | approveExtraction, list, get, create, update, delete, exportDictionary, libraryBrowse, importFromLibrary, linkReference |
mapping | list, create, update, delete, detectDuplicates, mergeDuplicates, exportInvesteeCollectionSheet |
calculation | list, create, evaluate, update, delete |
investee | list, get, create, update, deactivate, sendReminders |
submission | createUploadUrl, ingest, list, get, delete, updateStatus, correctValue, correctionHistory |
dqc | run, list, get |
gpData | createUploadUrl, ingest, ingestHistorical, list, get, aggregate, delete |
report | generate, regenerate, list, get, delete, updateNarrative, export, approve, email |
settings | getReportingPeriod, setReportingPeriod |
explorer | kpiTrends, export |
cockpit | summary, todos |
cycleAutomation | status |
lpPortal | submitManualKpis |
task | list, create, toggle, delete |
report.approve and report.email exist but are deliberately not surfaced in the Reports
screen — report delivery is by download pending a client decision. Do not treat their existence as
a shipped feature.
operator
Tenant operations: getDashboard, listOrganizations, getOrganization, createOrganizationOnboarding,
updateOrganizationPlan, suspendOrganization, reactivateOrganization, resendOrganizationInvite,
the globalLibrary* document procedures, the *SupportSession procedures, and listAuditLogs.
operatorIntelligence
Platform analytics: usage.getPlatformDashboard, usage.listByOrg, usage.listNearCap,
conversations.list, conversations.get, and gaps.listRanked.
Operator procedures that change a tenant's state (onboarding, plan changes, suspensions, global library deletions, and support sessions) write to the audit log, so every cross-tenant action is attributable.