Skip to main content

​
Main non-admin routes

  • POST /api/user/profile
  • PATCH /api/user/profile
  • GET/POST /api/user/onboarding
  • POST /api/auth/native-token
  • POST /api/user/sync-clerk
  • GET /api/mobile/start
  • GET /api/mobile/callback
  • POST /api/mobile/exchange
  • GET /api/mobile/verify
  • GET /api/mobile/version
  • GET /api/mobile/wallet-callback
  • GET/POST /api/invites/me
  • GET /api/invites/{code}
  • POST /api/invites/{code}/redeem
  • GET/POST /api/user/support/tickets
  • GET /api/user/check-username
  • GET/PATCH /api/user/settings

​
Runtime behavior highlights

  • Unauthenticated requests are rejected at route boundaries.
  • Profile updates upsert user records and persist profile fields.
  • Onboarding completion is idempotent and avoids duplicate onboarding reward entries. POST /api/user/onboarding returns { completed, freePackId } (freePackId is the granted PackPurchase.id, or null if the grant degraded).
  • Onboarding path can enroll users in global leaderboard and write initial points history.
  • Auth identity sync path updates app-side fields when identity provider data changes.
  • POST /api/mobile/exchange consumes a one-time 128-char hex MobileSession token and returns a Clerk sign-in ticket. No Clerk session is required on that call.
  • Native prefers the URL fragment (#token=) over the query string, then calls signIn.create({ strategy: 'ticket' }).
  • GET/PATCH /api/user/settings is the settings SoT. privateProfile mirrors User.isPrivate. Persist notifyTeams, notifyMilestones, and notifyCommunity separately.

​
Common outputs and side effects

  • Updated user profile payloads
  • Onboarding completion state transitions
  • Conditional points history writes for onboarding reward
  • Cache revalidation for dashboard/leaderboard views after profile completion flows

​
Known caveats

  • Some onboarding and sync behavior depends on external auth provider availability.
  • Backfill scripts exist for historical onboarding and profile consistency corrections.

​
Exclusions

  • Admin role escalation and privileged identity management are not covered in this section.