API overview
v1 (current)What's actually public today, and what isn't.
UAMSATech doesn't yet have a broad public API. Almost every route under /api/auth/* and /api/portal/* authenticates with the browser's own session cookie and exists to serve the portal's UI — calling them directly with an API key won't work, because they were never designed to be called by anything other than this app.
The one exception is /api/v1/usage, authenticated with a Bearer API key instead of a cookie. It exists specifically so the other products in the ecosystem (LecturerCraft, ScholarCraft, and so on, once they're built) can report metered usage back to the organization that owns them.
This is a deliberately small surface, not an oversight. Documenting internal cookie-authenticated routes as though they were a public API contract would be misleading — they can change shape at any time without notice, because nothing outside this app is meant to depend on them.