Backend API Overview

Base URL & Prefix

• Service runs on http://localhost:3000.
• All controllers sit behind the Nest global prefix /api.
• All controllers use paths relative to this prefix (e.g. @Controller('global-widgets') → /api/global-widgets/...).

Authentication

• Protected routes use BackendAuthGuard (JWT). Obtain tokens via:
  • POST /api/auth/register ➜ returns { accessToken, refreshToken, user }
  • POST /api/auth/login ➜ returns { accessToken, refreshToken, user }
• Supply Authorization: Bearer <accessToken> for guarded endpoints.

Common Response Shapes

• Most feature controllers return { success: boolean, data?: any, message?: string }.
• Analytics beacon returns { received: true } regardless of user resolution.
• Health endpoints return simple status payloads.

Cross-Origin & Validation

• CORS allows configured origins (defaults: 5701, 5200, 4200, 5300) and accepts requests without origin.
• Global ValidationPipe is active with transform=true, whitelist=false to allow flexible DTOs.

High-Level Domains

• Auth & Identity: /api/auth/*, /api/users/*
• AI & Agents: /api/ai/*, /api/ai-agents/*, /api/ai/learning/*
• Spaces & Universes: /api/spaces/*, /api/:spaceId/universes/*, /api/spaces/:spaceId/modules/*
• Modules & Marketplaces: /api/modules/*, /api/global-modules/*, /api/marketplace/*
• Content & Design: themes, widgets, properties, assets, templates, global resources
• Data & Storage: universe data CRUD, Mongo sync helpers, exports
• Commerce & Deployment: products/orders, deployment flows, marketplace listings
• Experimentals: Ferrari project generator, UI Builder, Singularity (flows), YJS/WebSocket advertised at /sync and /yjs

See the endpoint catalog for per-route details: /GoGrab-Space/sessions/session-13/reference/backend-api-endpoints.