API overview

Base URL (local): http://localhost:8787

Method	Path	Notes
GET	/health	Liveness
POST	/api/auth/otp/request	Email OTP
POST	/api/auth/otp/verify	Session cookie
GET	/api/auth/me	Current user
GET	/api/clients	Tenant clients
GET	/api/calendar	Master calendar
POST	/api/calendar/refresh	Rebuild from country pack
GET	/api/templates	Email templates A–G (staff)
POST	/api/templates/send	Enqueue / send via core-notify
GET	/api/templates/sends	Recent template sends
GET	/api/doc-drafts	Document drafts (staff)
POST	/api/doc-drafts	Compose draft from template A–G
GET	/api/doc-drafts/:id	Draft detail + placeholder readiness
PATCH	/api/doc-drafts/:id	Edit draft / mark ready / discard
POST	/api/doc-drafts/:id/send	Send ready draft via core-notify
GET	/api/doc-drafts/sends	Recent document draft sends
GET	/api/cs-cases	CS cases (staff)
POST	/api/cs-cases	Log inbound communication + initial memo
GET	/api/cs-cases/:id	CS case detail + memos
PATCH	/api/cs-cases/:id	Update status / priority / assignee
POST	/api/cs-cases/:id/memos	Append case memo
POST	/api/cs-cases/:id/notify	Notify assignee or escalate CS case
GET	/api/cs-cases/notifies	Recent CS case notifications
POST	/api/reports/weekly-digest/send	Email weekly progress digest (firm admin)
GET	/api/reports/weekly-digest/sends	Recent weekly digest sends
GET	/api/corppass/registrations	Corppass registry (staff)
POST	/api/corppass/registrations	Register holder
PATCH	/api/corppass/registrations/:id	Update / revoke
POST	/api/corppass/scan	Manual expiry scan
GET	/api/corppass/lifecycle	Corppass lifecycle cases (staff)
POST	/api/corppass/lifecycle	Open lifecycle case for registration
GET	/api/corppass/lifecycle/:id	Lifecycle case detail + readiness
PATCH	/api/corppass/lifecycle/:id	Complete checklist step / cancel
GET	/api/gst/requests	GST document request history (staff)
POST	/api/gst/scan	Manual GST template A auto-send scan
GET	/api/gst/worksheets	F5 worksheet list by year (staff)
GET	/api/gst/worksheets/:calendarEventId	F5 box mapping + doc coverage
PATCH	/api/gst/worksheets/:calendarEventId	Save F5 working amounts / status
GET	/api/gst/filings	F5 IRAS filing queue by year (staff)
POST	/api/gst/filings	Queue ready F5 worksheet for IRAS submit (HITL)
GET	/api/gst/filings/:id	Filing detail + box snapshot
PATCH	/api/gst/filings/:id	Confirm IRAS submit / cancel / fail
GET	/api/flow/rules	Case flow stages + adjacent-only policy (staff)
GET	/api/coordinator/board	Coordinator Kanban (staff)
PATCH	/api/coordinator/cases/:id	Move / assign case (validates stage transitions)
GET	/api/scheduler/dashboard	Progress summary + at-risk (staff)
GET	/api/scheduler/mine	Current user assignments (staff)
GET	/api/scheduler/tasks	Task assignments (staff)
GET	/api/scheduler/unassigned	Calendar events without assignee
GET	/api/scheduler/staff	Assignable staff + open counts
POST	/api/scheduler/auto	Least-loaded auto assign (firm admin)
POST	/api/scheduler/assign	Manual assign one event (firm admin)
PATCH	/api/scheduler/tasks/:id	Reassign / update status (firm admin); status only for own task (employee)
GET	/api/org/chart	Org chart tree (staff)
GET	/api/org/staff	Staff R&R list (staff)
POST	/api/org/units	Create org unit (firm admin)
PATCH	/api/org/units/:id	Update org unit (firm admin)
PATCH	/api/org/staff/:userId	Update staff R&R (firm admin)
POST	/api/org/bootstrap	Seed default SG org units (firm admin)
POST	/api/auth/access/exchange	Cloudflare Access JWT → session
GET	/api/auth/rbac/matrix	RBAC permission matrix
GET	/api/auth/rbac/me	Current user permissions
GET	/api/auth/rbac/users	Tenant users (platform admin)
PATCH	/api/auth/rbac/users/:id/role	Update user role (platform admin)
GET	/api/orch/registry	Engine routing table (staff)
GET	/api/orch/capabilities	Queue bindings + inline fallbacks (staff)
POST	/api/orch/dispatch	Manual queue dispatch (platform admin)
GET	/api/audit/actions	Audit action SSOT catalog (staff)
GET	/api/audit/logs	Scoped audit history (staff; tenant/self filter)
GET	/api/notify/channels	Notification channel catalog (staff)
POST	/api/notify/send	Multi-channel send via core-notify (staff write)
GET	/api/notify/history	Recent notifications by channel (staff)
GET	/api/folders/tree	Client folder tree by standard categories (session)
POST	/api/documents/presign	R2 upload
GET	/api/aud/judgements	Audit requirement list by YA (staff)
GET	/api/aud/judgements/:calendarEventId	Audit judgement detail + readiness
PATCH	/api/aud/judgements/:calendarEventId	Save / confirm audit judgement
GET	/api/cit/judgements	Form C / C-S judgement list by YA (staff)
GET	/api/cit/judgements/:calendarEventId	CIT judgement detail
PATCH	/api/cit/judgements/:calendarEventId	Save / confirm CIT judgement
GET	/api/cit/doc-packs	YA year-end doc pack list by YA (staff)
GET	/api/cit/doc-packs/:calendarEventId	CIT doc pack detail + coverage
PATCH	/api/cit/doc-packs/:calendarEventId	Update CIT doc pack workflow
GET	/api/cit/filings	Form C / C-S IRAS filing queue by YA (staff)
POST	/api/cit/filings	Queue ready Form C for manual IRAS submit (HITL)
GET	/api/cit/filings/:id	CIT filing detail + readiness blockers
PATCH	/api/cit/filings/:id	Confirm IRAS submit / cancel / fail
GET	/api/pit/intakes	PIT intake list by YA (staff)
GET	/api/pit/intakes/:calendarEventId	PIT intake detail + IRAS form judgement
PATCH	/api/pit/intakes/:calendarEventId	Save / confirm PIT intake
GET	/api/pit/doc-packs	PIT YA doc pack list by YA (staff)
GET	/api/pit/doc-packs/:calendarEventId	PIT doc pack detail + coverage
PATCH	/api/pit/doc-packs/:calendarEventId	Update PIT doc pack workflow
GET	/api/pit/filings	PIT IRAS filing queue by YA (staff)
POST	/api/pit/filings	Queue ready PIT intake for manual IRAS submit (HITL)
GET	/api/pit/filings/:id	PIT filing detail + readiness blockers
PATCH	/api/pit/filings/:id	Confirm IRAS submit / cancel / fail
GET	/api/dorm/waivers	Dormant IRAS waiver cases by YA (staff)
POST	/api/dorm/waivers	Open dormant waiver case for confirmed DORMANT Form C (HITL)
GET	/api/dorm/waivers/:id	Dormant waiver detail + readiness blockers
PATCH	/api/dorm/waivers/:id	Bank review, horizon plan, e-sign, or IRAS submit

MCP (PLT-MCP-01) will expose a read-only subset of these tools.