API

coThink API reference

Developer overview for the coThink REST API hosted at app.wecothink.com.

Base URL

All application API requests are made against:

https://app.wecothink.com/api/v1

Browser clients use cookie-based sessions with CSRF protection. Server-to-server integrations should use credentials issued for your organization and follow the authentication flow documented for your deployment.

Response format

Most tenant-scoped routes return a JSON envelope:

{
  "success": true,
  "data": { },
  "meta": { },
  "error": null
}

When success is false, error includes a machine-readable code and human-readable message. Authentication routes may return flat JSON objects during sign-in and OAuth flows.

API surface

Authentication

/api/v1/auth

Sign-in, session management, OAuth, passkeys, password recovery, and realtime tokens.

POST /api/v1/auth/login
GET /api/v1/auth/session
GET /api/v1/auth/oauth/providers
POST /api/v1/auth/logout

Tenant Workspaces

/api/v1/tenants/{tenantId}

Organization-scoped resources including rooms, files, tasks, and collaboration data.

Room and membership operations
Messages, files, and whiteboard content
Tasks, decisions, and calendar-linked work

Guided Sessions

/api/v1/tenants/{tenantId}/rooms/{roomId}/sessions

Session lifecycle, artifacts, facilitation state, and structured submissions.

Create and advance guided sessions
Submit structured session artifacts
Export session outcomes to workspace records

Personal Advisor

/api/v1/tenants/{tenantId}/personal-advisor

Advisor memory, planning proposals, and tenant-scoped assistant workflows.

Advisor context and memory endpoints
Autonomous planning proposals and approvals

Integrations and Providers

/api/v1/tenants/{tenantId}/providers

Connect AI providers, calendars, and other approved integrations for a tenant.

Provider configuration and credential management
Usage and routing controls

System and Health

/health, /api/system/status

Operational health endpoints for monitoring deployments and dependencies.

GET /health
GET /api/system/status

Authentication requirements

✓ Authenticated browser requests include session cookies and CSRF headers for mutating operations.
✓ Tenant routes require an active tenant context selected after sign-in.
✓ Role and room permissions are enforced server-side for every resource.
✓ Rate limits and abuse protections may apply to authentication and high-volume endpoints.

Product documentation · Security overview · Request API access