API reference

The machine-readable document is at /api/openapi.json. Mutations from the browser must be same-origin. Signed-in mutations also send the hb_csrf cookie value in the x-hb-csrf header.

• POST /api/auth/register, /api/auth/login, /api/auth/verify-email
• GET /api/jobs and POST /api/applications
• POST /api/enquiries and /api/contact
• POST /api/ai/chat — Gemini when GEMINI_API_KEY is set, otherwise the rules engine
• GET /api/health — process only. Add ?db=1 to check the database.