API Reference

The NestJS API is served under the global /api prefix (e.g. POST /api/auth/login) with interactive Swagger at /api/docs. Unless marked Public, every endpoint requires a valid access-token JWT; fine-grained access is enforced by @CheckPolicies (CASL — see Roles & Permissions). The tables below list the route, what it does, and the required CASL ability (— = any authenticated user).

This is a hand-maintained summary; the authoritative, always-current contract is the generated OpenAPI spec (pnpm --filter @cbdc-issuer/api generate:openapi) and the live Swagger UI.

Auth — /api/auth

Method & path	Description	Auth
POST /login	Email + password login	Public
POST /register	Register from an invitation	Public
POST /refresh	Rotate refresh cookie, issue new access token	Public (reads cookie)
POST /logout	Invalidate the session	authenticated
POST /forgot-password	Request a reset link	Public
POST /reset-password	Reset password via token	Public
POST /change-password	Change own password	authenticated

App config — /api/config

Method & path	Description	Auth
GET /	Public runtime config (currencyName, native token id, …)	Public

Users — /api/users

Method & path	Description	Ability
GET /	List internal users	read · User
GET /selectable	Users selectable as account members	read · User
GET /:id	Get a user	read · User
PATCH /me/pinned-wallets	Update own pinned accounts	read · User
PATCH /me/locale	Update own locale	read · User
PATCH /:id/roles	Change a user's roles	manage · User
PATCH /:id/deactivate	Deactivate a user	manage · User

Invitations — /api/invitations

Method & path	Description	Ability
POST /	Create an invitation	manage · Invitation
GET /	List invitations	read · Invitation
GET /validate/:token	Validate an invite token	Public
POST /:id/revoke	Revoke an invitation	manage · Invitation
POST /:id/resend	Resend an invitation	manage · Invitation

Organizations — /api/organizations

Method & path	Description	Ability
GET /	List organizations (Central only)	read · Organization
GET /:id	Get an organization	read · Organization
POST /	Create an organization	manage · Organization
PATCH /:id	Update an organization	manage · Organization
POST /:id/admins/invite	Invite an org admin	manage · Organization
POST /:id/exchange-address	Set exchange address	manage · Organization
POST /:id/freeze · /unfreeze	Freeze / unfreeze exchange	manage · Organization
PATCH /:id/chain-rpc	Update per-org RPC	manage · Organization
POST /:id/chain-rpc/test	Test an RPC endpoint	manage · Organization

Bridging — /api/organizations/:id

Method & path	Description	Ability
POST /disbursement-request	Fiat → CBDC disbursement	manage · Bridging
POST /redemption-request	CBDC → fiat redemption	manage · Bridging

Accounts (multisigs) — /api/multisigs

Method & path	Description	Ability
GET /	List accounts	—
POST /	Create a custom account	create · Multisig
GET /:id	Account detail	—
GET /:id/members	Members	—
GET /:id/policy	Decision policy	—
GET /:id/balance	Live balance	—
GET /:id/health	Chain reachability for the account	—
PATCH /:id	Edit label	manage · Multisig
POST /:id/archive · /unarchive	Archive / unarchive	manage · Multisig

Proposals — /api/multisigs/:multisigId/proposals

Method & path	Description	Ability
POST /mint	Mint proposal	create · Proposal
POST /burn	Burn proposal	create · Proposal
POST /transfer	Transfer proposal	create · Proposal
POST /group-changes	Group-change proposal	create · Proposal
GET /	List proposals	read · Proposal
GET /:proposalId	Proposal detail	read · Proposal
POST /:proposalId/execute	Execute (if pending exec)	create · Proposal
POST /:proposalId/withdraw	Withdraw proposal	create · Proposal

GET /api/approval-queue lists proposals awaiting the caller's vote (read · Proposal).

Votes — /api/multisigs/:multisigId/proposals/:proposalId/votes

Method & path	Description	Ability
POST /	Cast a vote (EXEC_TRY)	create · Vote
GET /	List votes	read · Vote

Whitelist — /api/multisigs/:multisigId/whitelist

Method & path	Description	Ability
GET /	List whitelist entries	—
POST /	Add entry	manage · WhitelistAddress
PATCH /:addressId	Edit entry	manage · WhitelistAddress
DELETE /:addressId	Remove entry	manage · WhitelistAddress

Operations & activity — /api/operations, /api/activity-log

Method & path	Description	Ability
GET /operations/lookup	Resolve an operation by attributes	read · Operation
GET /operations/:operationId	Operation detail	—
GET /activity-log	Unified activity feed	read · Operation

Tokens — /api/tokens

Method & path	Description	Ability
GET /	List tokens	—
GET /:id	Token detail	—
GET /autodetect	Autodetect on-chain token	manage · Token
POST /	Create token	manage · Token
PATCH /:id	Update token	manage · Token
DELETE /:id	Remove token	manage · Token

Address book — /api/address-book

Method & path	Description	Ability
GET /	List entries	read · AddressBook
POST /	Add entry	manage · AddressBook
PATCH /:entryId	Edit entry	manage · AddressBook
DELETE /:entryId	Delete entry	manage · AddressBook

Control panel — /api/control-panel

Method & path	Description	Ability
GET /alerts	Operational alerts	manage · Organization
GET /internal-users	Internal-users listing	manage · User

Dashboard & export

Method & path	Description	Ability
GET /api/dashboard/metrics	Supply / balances / external circulating	read · Dashboard
GET /api/export/transactions	Export transactions (csv/json)	read · Export
GET /api/export/governance	Export governance activity	read · Export