# What's documented

Source: https://developers.leonai.io/docs/coverage/

This page is a completeness map: every REST endpoint the API serves and every webhook
event it emits, with a link to where each is covered. The authoritative, always-current
contract is the [OpenAPI spec](https://developers.leonai.io/docs/api-reference/) at `/api/v1/openapi.json`.

- **`[x]`** — live on `api.short.leonai.io` and described in the OpenAPI spec.
- **`[ ]`** — **not implemented**. The path returns 404 today. These were listed
  as available in an earlier revision of this page; they are kept, unticked, so it
  is obvious they are planned rather than silently missing. Do not build against them.

## Auth — `/api/v1/auth` · [Authentication](https://developers.leonai.io/docs/authentication/)

- [x] `POST /api/v1/auth/signup`
- [x] `POST /api/v1/auth/login`
- [x] `POST /api/v1/auth/refresh`
- [x] `POST /api/v1/auth/logout`
- [ ] `POST /api/v1/auth/logout-all` — **not implemented**, returns 404
- [x] `GET /api/v1/auth/me`
- [x] `GET /api/v1/me` — caller identity, plan and API-key scopes; any valid API key
- [x] `POST /api/v1/auth/verify-email`
- [x] `POST /api/v1/auth/resend-verification`
- [x] `POST /api/v1/auth/forgot-password`
- [x] `POST /api/v1/auth/reset-password`
- [x] `POST /api/v1/auth/register` — alias of `/auth/signup`
- [x] `GET /api/v1/auth/oauth/providers` — which SSO providers are configured
- [x] `GET /api/v1/auth/oauth/:provider/start` — begin an SSO login
- [x] `GET /api/v1/auth/oauth/:provider/callback` — provider redirect target
- [x] `POST /api/v1/auth/oauth/exchange` — trade the one-time code for a session

## 2FA — `/api/v1/auth/2fa` · [2FA](https://developers.leonai.io/docs/guides/two-factor/)

- [x] `POST /api/v1/auth/2fa/setup`
- [x] `POST /api/v1/auth/2fa/enable`
- [x] `POST /api/v1/auth/2fa/disable`
- [x] `GET /api/v1/auth/2fa/status`
- [x] `POST /api/v1/auth/2fa/verify`

## API keys — `/api/v1/api-keys` · [Authentication](https://developers.leonai.io/docs/authentication/#creating-a-key)

- [x] `POST /api/v1/api-keys`
- [x] `GET /api/v1/api-keys`
- [x] `PATCH /api/v1/api-keys/:id`
- [x] `DELETE /api/v1/api-keys/:id`

## Users / GDPR — `/api/v1/users`

- [x] `GET /api/v1/users/me/export` — GDPR data export
- [x] `DELETE /api/v1/users/me` — right to erasure
- [x] `GET /api/v1/users/me/consent` — effective cookie/marketing consent
- [x] `PUT /api/v1/users/me/consent` — record a decision. Append-only: a withdrawal adds a row rather than editing the grant, so the proof that earlier processing was lawful survives the opt-out (5-year retention).

## Links — `/api/v1/links` · [Links](https://developers.leonai.io/docs/guides/links/)

- [x] `POST /api/v1/links`
- [x] `GET /api/v1/links`
- [x] `GET /api/v1/links/:id` (id or short code)
- [x] `PATCH /api/v1/links/:id`
- [x] `DELETE /api/v1/links/:id`
- [ ] `GET /api/v1/links/:id/stats` — **not implemented**, returns 404
- [x] `POST /api/v1/links/bulk` — CSV or pre-parsed rows, max 1000, per-row results
- [x] `GET /api/v1/links/export` — CSV or JSON attachment, max 10,000
- [x] `GET /api/v1/links?folderId={id|root}` — filter by [folder](https://developers.leonai.io/docs/guides/folders/)

## Folders — `/api/v1/folders` · [Folders](https://developers.leonai.io/docs/guides/folders/)

- [x] `POST /api/v1/folders`
- [x] `GET /api/v1/folders`
- [x] `PATCH /api/v1/folders/:id`
- [x] `DELETE /api/v1/folders/:id`
- [x] `PUT /api/v1/folders/:id/links`

## Analytics & conversions — `/api/v1/analytics` · [Analytics](https://developers.leonai.io/docs/guides/analytics/)

- [x] `GET /api/v1/analytics/links/:id`
- [x] `GET /api/v1/analytics/account`
- [ ] `GET /api/v1/analytics/realtime/:id` — **not implemented**, returns 404
- [ ] `GET /api/v1/analytics/export/:id` — **not implemented**, returns 404
- [ ] `GET /api/v1/analytics/summary` — **not implemented**, returns 404
- [x] `GET /api/v1/analytics/conversions/summary`
- [x] `GET /api/v1/analytics/:linkId/conversions`
- [x] `POST /api/v1/conversions` — API-key only, Business+ (was listed here as `/api/v1/track/conversions`, which returns 404)

## Shareable analytics — `/api/v1/analytics/.../share` · [Shareable analytics](https://developers.leonai.io/docs/guides/shareable-analytics/)

- [x] `POST /api/v1/analytics/:linkId/share`
- [x] `GET /api/v1/analytics/:linkId/share`
- [x] `DELETE /api/v1/analytics/shares/:id`

## Retargeting pixels — `/api/v1/pixels` · [Retargeting pixels](https://developers.leonai.io/docs/guides/retargeting-pixels/)

- [x] `POST /api/v1/pixels`
- [x] `GET /api/v1/pixels`
- [x] `PATCH /api/v1/pixels/:id`
- [x] `DELETE /api/v1/pixels/:id`
- [x] `GET /api/v1/links/:linkId/pixels`
- [x] `PUT /api/v1/links/:linkId/pixels`

## Branding — `/api/v1/branding` · [White-label branding](https://developers.leonai.io/docs/guides/white-label/)

- [x] `GET /api/v1/branding`
- [x] `PUT /api/v1/branding` — Enterprise

## Imports — `/api/v1/imports` · [Import from Bitly](https://developers.leonai.io/docs/guides/bitly-import/)

- [x] `POST /api/v1/imports/bitly`

## Smart routing — `/api/v1/links/:linkId/routing` · [Smart routing](https://developers.leonai.io/docs/guides/smart-routing/)

- [x] `POST /api/v1/links/:linkId/routing`
- [x] `GET /api/v1/links/:linkId/routing`
- [x] `GET /api/v1/links/:linkId/routing/:ruleId`
- [x] `PATCH /api/v1/links/:linkId/routing/:ruleId`
- [x] `DELETE /api/v1/links/:linkId/routing/:ruleId`
- [x] `GET /api/v1/links/:linkId/ab-report` — per-variant clicks and uplift

## Custom domains — `/api/v1/domains` · [Custom domains](https://developers.leonai.io/docs/guides/domains/)

- [x] `POST /api/v1/domains`
- [x] `GET /api/v1/domains`
- [x] `GET /api/v1/domains/:id`
- [x] `POST /api/v1/domains/:id/verify`
- [x] `DELETE /api/v1/domains/:id`
- [x] `PATCH /api/v1/domains/:id`
- [x] `GET /api/v1/domains/:id/verification` — the TXT record to publish
- [ ] `GET /api/v1/domains/providers` — **not implemented**, returns 404. Superseded by `detect-provider`, which reports the provider for the domain you actually have rather than making you match it against a catalogue.
- [ ] `GET /api/v1/domains/:id/setup/:providerId` — **not implemented**, returns 404. Superseded by `auto-configure` (Cloudflare) and the per-provider instructions the dashboard renders for everyone else.
- [x] `GET /api/v1/domains/:id/detect-provider` — live NS lookup
- [x] `POST /api/v1/domains/:id/auto-configure` — one-click Cloudflare. Takes a `apiToken` in the body, uses it for that one request, and discards it — nothing is stored, so reconnecting later asks for it again.

## Webhooks — `/api/v1/webhooks` · [Webhooks](https://developers.leonai.io/docs/guides/webhooks/)

- [x] `POST /api/v1/webhooks`
- [x] `GET /api/v1/webhooks`
- [x] `GET /api/v1/webhooks/:id`
- [x] `PATCH /api/v1/webhooks/:id`
- [x] `DELETE /api/v1/webhooks/:id`
- [x] `GET /api/v1/webhooks/:id/deliveries` — recent attempts with status and response code

## AI — `/api/v1/ai` · [AI features](https://developers.leonai.io/docs/guides/ai/)

- [ ] `POST /api/v1/ai/suggest-slug` — **not implemented**, returns 404
- [ ] `POST /api/v1/ai/insights` — Business+ — **not implemented**, returns 404
- [ ] `POST /api/v1/ai/anomalies` — **not implemented**, returns 404
- [ ] `GET /api/v1/ai/status` — **not implemented**, returns 404

## Teams — `/api/v1/teams` · [Teams](https://developers.leonai.io/docs/guides/teams/)

- [x] `POST /api/v1/teams`
- [x] `GET /api/v1/teams`
- [x] `GET /api/v1/teams/:teamId/members`
- [x] `POST /api/v1/teams/:teamId/invites`
- [x] `GET /api/v1/teams/:teamId/invites`
- [x] `DELETE /api/v1/teams/:teamId/invites/:inviteId`
- [x] `POST /api/v1/teams/invites/accept`
- [x] `DELETE /api/v1/teams/:teamId/members/:memberId`
- [x] `PATCH /api/v1/teams/:teamId/members/:memberId`

## Bio pages — `/api/v1/bio-pages` · [Link-in-bio](https://developers.leonai.io/docs/guides/link-in-bio/)

- [x] `POST /api/v1/bio-pages`
- [x] `GET /api/v1/bio-pages`
- [x] `GET /api/v1/bio-pages/:id`
- [x] `PATCH /api/v1/bio-pages/:id`
- [x] `DELETE /api/v1/bio-pages/:id`
- [x] `POST /api/v1/bio-pages/:id/publish`
- [x] `POST /api/v1/bio-pages/:id/unpublish`
- [x] `POST /api/v1/bio-pages/:id/items`
- [x] `PUT /api/v1/bio-pages/:id/items/order`
- [x] `PATCH /api/v1/bio-pages/:id/items/:itemId`
- [x] `DELETE /api/v1/bio-pages/:id/items/:itemId`
- [x] `POST /api/v1/bio-pages/:id/avatar` — multipart upload
- [x] `DELETE /api/v1/bio-pages/:id/avatar`
- [x] `POST /api/v1/bio-pages/:id/items/:itemId/thumbnail` — multipart upload
- [x] `DELETE /api/v1/bio-pages/:id/items/:itemId/thumbnail`
- [x] `GET /api/v1/bio-pages/:id/subscribers` — JSON or CSV
- [x] `DELETE /api/v1/bio-pages/:id/subscribers/:subscriberId`
- [x] `GET /api/v1/bio-pages/:id/analytics` — views and per-item clicks

## Billing (Sumit) — `/api/v1/billing` · [Billing](https://developers.leonai.io/docs/guides/billing/)

- [x] `GET /api/v1/billing/plans`
- [x] `GET /api/v1/billing/subscription`
- [x] `POST /api/v1/billing/checkout`
- [x] `POST /api/v1/billing/confirm`
- [x] `POST /api/v1/billing/cancel`
- [x] `POST /api/v1/billing/resume`
- [x] `GET /api/v1/billing/invoices`
- [x] `POST /api/v1/billing/sumit-webhook`

## Public — root & `/api/v1/public`

- [x] `GET /:shortCode` — redirect + click tracking ([Links](https://developers.leonai.io/docs/guides/links/), [Smart routing](https://developers.leonai.io/docs/guides/smart-routing/))
- [x] `POST /:shortCode/verify` — password-protected links
- [ ] `GET /:shortCode/info` — link preview — **not implemented**, returns 404
- [x] `GET /:shortCode/qr` — [QR codes](https://developers.leonai.io/docs/guides/qr-codes/)
- [x] `GET /api/v1/public/bio/:slug` — [Link-in-bio](https://developers.leonai.io/docs/guides/link-in-bio/)
- [x] `POST /api/v1/public/bio/:slug/items/:itemId/click`
- [x] `GET /api/v1/public/analytics/:token` — [Shareable analytics](https://developers.leonai.io/docs/guides/shareable-analytics/)
- [x] `POST /api/v1/public/bio/:slug/view`
- [x] `POST /api/v1/public/bio/:slug/subscribe` — email capture
- [x] `GET /api/v1/public/media/*` — uploaded bio avatars and thumbnails
- [x] `POST /api/v1/public/report/:shortCode` — report abuse

## QR codes · [QR codes](https://developers.leonai.io/docs/guides/qr-codes/)

- [x] `GET /:shortCode/qr` — public image, also listed above
- [x] `POST /api/v1/qr/bulk` — many short codes in one call

## Webhook events · [Webhooks](https://developers.leonai.io/docs/guides/webhooks/#payload-per-event)

- [x] `link.created`
- [x] `link.updated`
- [x] `link.deleted`
- [x] `link.clicked`
- [ ] `link.expired` — **reserved**: accepted in a subscription, never sent yet
- [ ] `link.limit_reached` — **reserved**: accepted in a subscription, never sent yet
- [x] `domain.verified`
- [ ] `domain.ssl_ready` — **reserved**: accepted in a subscription, never sent yet
- [x] `subscription.upgraded`
- [x] `subscription.cancelled`