HTTP API

Look up HTTP API headers, routes, status codes, and errors.

The Siglata HTTP API exposes core workspace services, authentication flows, and data transfer pipelines. The API provides typed error handling, strict multi-tenant boundaries, and internationalization.

The default production base URL is:

https://www.siglata.com

Standard Headers

All requests to the Siglata API utilize standard HTTP headers:

Core Service API

Service Health & Session Check

Inspect API availability, active localization, and current session identity.

GET /api HTTP/1.1
Host: www.siglata.com
Authorization: Bearer <optional-token>
x-siglata-locale: en-US

Response (200 OK)

{
  "service": "siglata",
  "status": "ok",
  "locale": "en-US",
  "user": {
    "id": "usr_9f8a7b6c5d",
    "email": "alex@example.com",
    "name": "Alex Smith",
    "image": null
  }
}

When called without an active session or token, user returns null.

Authentication Endpoints (/auth/*)

Authentication endpoints manage passwordless credentials, sessions, and multi-tenant organizations.

Request Magic Link

Sends a one-time sign-in link to the user’s email address in their requested language.

POST /auth/sign-in/magic-link HTTP/1.1
Host: www.siglata.com
Content-Type: application/json
x-siglata-locale: en-US

{
  "email": "alex@example.com"
}

Response (200 OK)

{
  "status": true
}

Verify Magic Link

Verifies a one-time magic link token and sets a secure, HTTP-only session cookie.

GET /auth/magic-link/verify?token=tok_3b4c5d6e7f HTTP/1.1
Host: www.siglata.com

Get Active Session

Retrieves the currently authenticated session and user record.

GET /auth/get-session HTTP/1.1
Host: www.siglata.com

Sign Out

Invalidates the active session and clears authentication cookies.

POST /auth/sign-out HTTP/1.1
Host: www.siglata.com

Organization Management

Manage multi-tenant workspace boundaries and roles:

Create Organization

POST /auth/organization/create

• Body: { "name": "Acme Corp", "slug": "acme-corp" }
• Response: Created organization record with ID.

List User Organizations

GET /auth/organization/list

• Response: Array of organizations the user belongs to, including roles.

Get Organization Details

GET /auth/organization/get?organizationId=org_1a2b3c4d5e

• Response: Detailed organization profile, members, and metadata.

Invite Team Member

POST /auth/organization/invite-member

• Headers: x-siglata-locale: en-US (or pt-BR)
• Body: { "email": "dev@example.com", "role": "member", "organizationId": "org_1a2b3c4d5e" }
• Response: Created invitation record.

List Pending Invitations

GET /auth/organization/list-invitations?organizationId=org_1a2b3c4d5e

• Response: Array of pending invitations.

Cancel Invitation

POST /auth/organization/cancel-invitation

• Body: { "invitationId": "inv_9a8b7c6d5e" }

Update Member Role

POST /auth/organization/update-member-role

• Body: { "memberId": "usr_3c4d5e6f7g", "role": "admin", "organizationId": "org_1a2b3c4d5e" }

Remove Member

POST /auth/organization/remove-member

• Body: { "memberIdOrEmail": "usr_3c4d5e6f7g", "organizationId": "org_1a2b3c4d5e" }

OAuth 2.0 Discovery Endpoints

Siglata publishes standard discovery documents for OAuth 2.0 and MCP clients:

• GET /.well-known/oauth-authorization-server
• GET /.well-known/openid-configuration
• GET /.well-known/oauth-protected-resource/v1/mcp

Model Context Protocol & Transfer Endpoints (/v1/mcp/*)

The /v1/mcp/* endpoints handle JSON-RPC protocol messages and high-throughput binary file transfers. tools/list exposes only two tools, execute and search, and management operations run inside execute scripts.

JSON-RPC Streamable HTTP

POST /v1/mcp HTTP/1.1
Host: www.siglata.com
Authorization: Bearer <oauth-access-token>
Content-Type: application/json

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "execute",
    "arguments": {
      "script": "return await files_list({ state: 'active', limit: 25 });"
    }
  }
}

Upload Binary Chunk

Transfers a single 8 MiB part for an active upload reservation created via upload_begin.

PUT /v1/mcp/uploads/{uploadId}/parts/{partNumber} HTTP/1.1
Host: www.siglata.com
Authorization: Bearer <oauth-access-token>
Content-Type: application/octet-stream

<raw binary bytes: exactly 8,388,608 bytes, or remaining bytes for final part>

• partNumber: 1-indexed integer (1 to 10,000).
• Response: 200 OK on successful chunk verification and storage.

Authenticated Binary Download

Streams stored file bytes directly to the authorized caller.

GET /v1/mcp/files/{fileId}/download HTTP/1.1
Host: www.siglata.com
Authorization: Bearer <oauth-access-token>

• Response: 200 OK with Content-Type matching original media type, Content-Length, and Content-Disposition: attachment.
• Verifies active organization membership before initiating the stream.

HTTP Status Codes

Error Taxonomy

Siglata returns structured, typed errors with predictable machine-readable codes:

{
  "code": "quota_exceeded",
  "message": "Storage quota limit reached for this organization"
}

Common Error Codes