Route production context into an LLM without surrendering the security boundary.

Base URL: https://api.fullstackvibes.com. The route endpoint assembles context artifacts into a bounded prompt bundle with provenance, source hashes, quality signals, and prompt injection or hijack warnings.

Route Context

POST /api/v1/context/route

Use execute:false to inspect the assembled bundle before any model call. If prompt injection indicators are found, execution is blocked.

{
  "contextId": "ctx_81a1eeeeeeb6",
  "artifactSlug": "secure-agentic-codebase-onboarding",
  "task": "Create a safe onboarding plan for a new developer using an agent.",
  "targetModelClass": "7b",
  "execute": false,
  "maxTokens": 900,
  "temperature": 0.2
}

Passwordless Auth

POST /api/v1/auth/passwordless/start

{
  "email": "user@example.com",
  "redirectUrl": "https://fullstackvibes.com/login"
}

POST /api/v1/auth/passwordless/verify

{
  "challengeId": "uuid",
  "email": "user@example.com",
  "token": "magic-link-token"
}

Magic-link tokens are stored hashed. Successful verification sets a secure HttpOnly session cookie.

Identity Model

Canonical context URLs use immutable IDs plus readable slugs:

/context/{contextId}/{slug}

Slugs are readable decoration. GraphQL, RAG, reports, canvases, votes, forks, citations, and route sessions attach to immutable IDs.