API

Two small interfaces. One your company can expose so the team methodology is stored on your side; one we expose so the extension and the CLI can check a key and fetch the methodology pack.

1. Your company endpoint (optional)

If you chose "Your company endpoint" as the place where the learning lives, AuditFellow stores the team methodology through a small REST interface that you run. You give us its base URL and a credential; we send the credential on every call as Authorization: Bearer <credential>. Everything is JSON over HTTPS. Nothing else about your systems is needed.

Method and path	What it does	Answer we expect
`GET /ping`	The connection test from the onboarding and the Organization page. Called once when you save, and occasionally afterwards.	`200` with any JSON body, for example `{"ok":true}`. A `401` or `403` is reported as a refused credential.
`GET /methodology/{layer}`	Reads a layer. `layer` is `team` today; more layers may follow.	`200` with `{"content":"…markdown…","updatedAt":"2026-09-02T18:00:00Z","version":12}`, or `404` when the layer has never been written.
`PUT /methodology/{layer}`	Writes a layer after a correction was applied. Body: `{"content":"…markdown…","updatedAt":"…","version":13,"by":"admin@company.com"}`.	`200` or `204`. Answer `409` if `version` is older than what you hold and we will read, merge and retry.
`GET /methodology`	Lists the layers you hold.	`200` with `{"layers":[{"layer":"team","updatedAt":"…","version":13}]}`.

Example: a minimal endpoint in Node

import express from 'express';
const app = express(); app.use(express.json({ limit: '2mb' }));
const store = {}; const TOKEN = process.env.AUDITFELLOW_TOKEN;
app.use((req, res, next) => req.headers.authorization === `Bearer ${TOKEN}` ? next() : res.status(401).json({ error: 'unauthorized' }));
app.get('/ping', (req, res) => res.json({ ok: true }));
app.get('/methodology', (req, res) => res.json({ layers: Object.entries(store).map(([layer, v]) => ({ layer, updatedAt: v.updatedAt, version: v.version })) }));
app.get('/methodology/:layer', (req, res) => store[req.params.layer] ? res.json(store[req.params.layer]) : res.status(404).end());
app.put('/methodology/:layer', (req, res) => { store[req.params.layer] = req.body; res.status(204).end(); });
app.listen(8443);

Keep the content as plain markdown files if you prefer; the shape above is all we rely on. Our calls come from Cloudflare's network with the user agent AuditFellow/1.0.

2. The AuditFellow API (used by the extension and the CLI)

Method and path	What it does	Notes
`POST /v1/validate`	Checks a key and binds it to a device. Body: `{"key":"af_live_…","device_id":"…","device_name":"…"}`.	Answers `{"valid":true,"token":"…","profile":"auditor","nextCheckInSeconds":86400,"graceSeconds":604800}`. Called once a day per device; `409` when the key is bound to another device.
`POST /v1/pack`	Downloads the methodology pack for a valid token. Body: `{"token":"…"}`.	JSON with `core`, `skills`, `knowledge`, `globalRules`, `teamRules`. Cached an hour by the clients.
`GET /api/config`	Public configuration: prices, check cadence, whether Google sign-in and email codes are on.	No authentication.

Base URL: . Questions: the contact form.