# CentraKit

- [CentraKit Docs](/): Start here for CentraKit product guides, system admin, the REST API, MCP server and CLI, AI agent access, and the architecture and operations notes.
- Getting Started
  - [Overview](/getting-started/overview): The CentraKit apps, every product area with its route and guide, and the local URLs for each app.
  - [Local Development](/getting-started/local-development): Install CentraKit, start the local Supabase stack and the apps with or without Portless, and sign in with the seeded personas.
  - [Deployment](/getting-started/deployment): How the five CentraKit apps deploy as services in one Vercel project, including domains, routing rewrites and the 11 crons in vercel.json.
- Product

  - **Workspace**
  - [Dashboard](/product/dashboard): What the organization dashboard shows, including metric cards, the operations pulse, capacity allocation, recent activity and the people reminders for absences, celebrations and HR deadlines.
  - [Command center](/product/command-center): How to use the command center to jump to pages, search records, create items, run workflows and start AI prompts from one keyboard-driven dialog.
  - [Notifications](/product/notifications): How notifications reach you in the topbar and the Notifications hub, how to act on approvals and replies inline, and how watch levels and channel preferences control what you receive.
  - [Approvals](/product/approvals): How approval rules make risky actions by people, AI agents, workflows, MCP clients and API keys wait for a human decision, and how approvers decide, escalate and expire requests.
  - [Chat](/product/chat): How the CentraKit AI assistant works in the Chats page and side panel, including Ask, Plan and Agent modes, models, attachments, commands, approvals, agent runs, sharing, contextual actions, knowledge retrieval and organization AI settings.
  - [Inbox](/product/inbox): How the Inbox shows customer conversations from WhatsApp and web channels, how staff reply with attachments and AI suggestions, take over from the AI, approve AI order proposals and track delivery.

  - **Customers and sales**
  - [Customers](/product/customers): How to manage customers, their contacts, locations, installed assets, notes and files, and how KvK and VIES lookups and @ and
  - [Customer portal](/product/customer-portal): What customers see in the customer portal, how they accept, reject or request changes to quotes, pay invoices, follow orders and view assets, and which portal pages and token links work without signing in.
  - [Quotes](/product/quotes): How quotes work at /quotes, from the pipeline board and versioned sending to customer acceptance, deposits, PDFs, and turning a quote into an invoice, order or task.
  - [Invoices](/product/invoices): How invoices work at /invoices, including creation from quotes and tasks, sending, online payment through Stripe, recorded payments, credit notes, write-offs, reminders and the Payments page.
  - [Orders](/product/orders): Sales orders at /orders, with stock reservation, fulfillment through shipments, invoicing policies, digital delivery, returns and promotions.
  - [Products](/product/products): The product catalog at /products, with variants, inventory levels and stock movements, suppliers, purchase orders, image lookup, and public product pages.
  - [Content](/product/content): The /content hub for document and task templates with their lifecycles and automations, product brands, the product category tree, and organization tags.

  - **Work**
  - [Tasks](/product/tasks): How to plan, track, bill and finish work with tasks, including the board, subtasks, materials, time entries, comments and the task lifecycle.
  - [Agenda](/product/agenda): How to schedule agenda items in shared and personal calendars, plan task work on the Planning board, subscribe through iCalendar feeds and import Google Calendar events.
  - [Files](/product/files): How to store, share and download organization files in drives and folders, with uploads, versions, comments, share links, ZIP downloads and the Files API.

  - **People**
  - [People](/product/people): How to manage employees, contracts, documents, skills, working hours, equipment, onboarding and offboarding checklists, pre-boarding links, HR settings and workforce insights in the People hub.
  - [Hiring](/product/hiring): How to open jobs, publish them on the careers page, move candidates through stages on a board, score and interview them, analyze CVs, send candidate emails and hire a candidate into People.
  - [Time](/product/time): How to log hours with the weekly timesheet, timer and clock in and out, submit and approve timesheets, request and approve time off, report sick, and set up leave types, policies and blackout periods.
  - [Expenses](/product/expenses): How to create expense claims from receipts, mileage and per diem, group them in trips, check them against policies, approve and reimburse them, and rebill billable expenses to customers.

  - **Insights and automation**
  - [Insights](/product/insights): How the Insights hub reports revenue, quotes, receivables, margin, products, customers and stock from internal CentraKit data, with deterministic forecasts, rule-based insights and CSV or Excel exports.
  - [Workflows](/product/workflows): How lifecycles move quotes, invoices, tasks, orders, purchase orders and shipments through their stages, and how automations react to events, schedules and webhooks.
  - [Integrations](/product/integrations): How the integrations marketplace connects WhatsApp Business inbox channels, Google Calendar and signed incoming and outgoing webhooks to an organization.

  - **Organization**
  - [Organizations](/product/organizations): How organizations work as the tenant boundary in CentraKit, and how to create, switch between, transfer and delete them.
  - [Settings and branding](/product/settings-and-branding): The organization settings page, covering general details, company information, social links, finance defaults, email addresses, export formats, lifecycles, logo, colors and brand images.
  - [Access control](/product/access-control): How to manage an organization's users, invitations, teams, roles and approval rules, and how built-in and custom roles grant permissions.
  - [Billing and usage](/product/billing-and-usage): How an organization chooses a plan, pays through Stripe Checkout and the Stripe Customer Portal, and tracks metered usage, credits and limits on the Usage and Limits page.
  - [Audit log](/product/audit-log): How to review, filter, inspect and export the organization audit log, including restricted details, CSV exports, retention per plan and the audit API.
  - [Profile](/product/profile): How to manage your personal details, language, regional formats, theme, sign-in methods and notification channels, and which account pages live outside an organization.
- Developers
  - [REST API](/developers/api): CentraKit REST API base URLs, authentication, organization scoping, pagination, and a map of every route under /api/v1.
  - [Authentication](/developers/authentication): How the CentraKit API authenticates browser sessions and bearer tokens, and how clients get tokens through Supabase OAuth 2.1, PKCE and dynamic client registration.
  - [Errors](/developers/errors): The RFC 9457 problem details format that every CentraKit API and MCP error uses, how codes and statuses are derived, and how to handle APPROVAL_REQUIRED.
  - [Webhooks](/developers/webhooks): Send signed CentraKit events to your HTTPS endpoints and receive external webhooks that start workflows, including signatures, secret and token rotation, delivery retries, and the REST and MCP operations.
  - [MCP server](/developers/mcp): Connect AI clients to the CentraKit product MCP server and the docs MCP server, with OAuth setup, scopes, approvals and the full list of 74 product tools.
  - [CLI](/developers/cli): Every centrakit CLI command and global flag, how it signs in and resolves the API base URL, its configuration files and environment variables, and how releases are packaged.
  - [OpenAPI](/developers/openapi): Where the CentraKit OpenAPI 3.2 specification lives, how it is generated from route JSDoc and Zod schemas, and how the TypeScript client, reference pages and drift check are built from it.
  - [Docs for AI agents](/developers/ai-agents): How AI agents and LLM tools read the CentraKit docs through llms.txt, Markdown page URLs, the docs MCP server and Ask AI, and how they act on CentraKit data through the product MCP server.
- Openapi
  - [Accept a quote.](/openapi/acceptQuote): Mark a quote accepted from the authenticated organization context.
  - [Add a customer contact.](/openapi/addCustomerContact): Add a linked contact to a customer.
  - [Add a customer location.](/openapi/addCustomerLocation): Add a service or billing location to a customer.
  - [Add a customer note.](/openapi/addCustomerNote): Add a note to a customer timeline.
  - [Add an invoice note.](/openapi/addInvoiceNote): Add an internal note to an invoice.
  - [Add a product supplier link.](/openapi/addProductSupplierLink): Link a supplier to a product.
  - [Add a quote note.](/openapi/addQuoteNote): Add an internal note to a quote.
  - [Add a task comment.](/openapi/addTaskComment): Add a comment to a task.
  - [Add a task time entry.](/openapi/addTaskTimeEntry): Add a time entry to a task.
  - [Adjust inventory stock.](/openapi/adjustInventoryStock): Apply a stock adjustment and return the updated stock record.
  - [Advance a invoice lifecycle stage.](/openapi/advanceInvoiceLifecycle): Moves the invoice to a manual milestone of its lifecycle. Only stages the lifecycle marks as manually advanceable are accepted.
  - [Advance an order lifecycle stage.](/openapi/advanceOrderLifecycle): Moves the order to a manual milestone of its lifecycle. Only stages the lifecycle marks as manually advanceable are accepted.
  - [Advance a quote lifecycle stage.](/openapi/advanceQuoteLifecycle): Moves the quote to a manual milestone of its lifecycle. Only stages the lifecycle marks as manually advanceable are accepted.
  - [Advance a task lifecycle stage.](/openapi/advanceTaskLifecycle): Moves the task to a manual milestone of its lifecycle. Only stages the lifecycle marks as manually advanceable are accepted.
  - [Append a chat message.](/openapi/appendChatMessage): Append a message to an organization chat thread.
  - [Archive an inventory stock record.](/openapi/archiveInventoryStockRecord): Archive an inventory stock record.
  - [Cancel a direct resumable Files upload.](/openapi/cancelFileUpload): Release the upload reservation and delete its Storage object when present.
  - [Cancel an invoice.](/openapi/cancelInvoice): Cancel a draft, sent, or overdue invoice.
  - [Cancel a sales order.](/openapi/cancelOrder): Cancel an order and release its reserved stock. A partly shipped order keeps what shipped and cancels the remainder. Returns 409 `APPROVAL_REQUIRED` with an `approvalId` when an approval policy wants a decision first.
  - [Cancel a workflow run.](/openapi/cancelWorkflowRun): Cancel a queued, running, or waiting organization workflow run. Completed, failed, and cancelled runs are left unchanged.
  - [Confirm a sales order.](/openapi/confirmOrder): Confirm a draft order and reserve stock. Lines that cannot be reserved become backorders. Returns 409 `APPROVAL_REQUIRED` with an `approvalId` when an approval policy wants a decision first.
  - [Copy Files nodes recursively.](/openapi/copyFileNodes): Transactionally clone selected folder trees and resume current-version Storage copies through a durable idempotent operation.
  - [Create an agenda item.](/openapi/createAgendaItem): Create an agenda item in an editable calendar for the specified organization.
  - [Create a brand.](/openapi/createBrand): Create a brand for the specified organization.
  - [Create a customer.](/openapi/createCustomer): Create a customer for the specified organization.
  - [Create a customer asset.](/openapi/createCustomerAsset): Create a customer asset for the specified organization.
  - [Add a customer asset note.](/openapi/createCustomerAssetNote): Add an internal note to a customer asset.
  - [Create an employee.](/openapi/createEmployee): Create an employee record without a user account. Every organization member already has one.
  - [Create an expense claim.](/openapi/createExpense): Create a draft claim, mileage entry, or per diem. Upload receipts in the app; this endpoint accepts JSON only.
  - [Create a Files download URL.](/openapi/createFileDownload): Authorizes the file node and returns a short-lived signed download URL without exposing its Storage object path.
  - [Create a direct resumable Files upload.](/openapi/createFileUpload): Reserve organization storage quota and return a short-lived signed TUS transport. File bytes are uploaded directly to Storage.
  - [Download selected Files as ZIP.](/openapi/createFileZipExport): Streams small authorized selections immediately and queues larger selections as expiring private artifacts.
  - [Create an inventory location.](/openapi/createInventoryLocation): Create an inventory location for an organization.
  - [Create an inventory stock record.](/openapi/createInventoryStockRecord): Create an inventory stock record for a product.
  - [Create an invoice.](/openapi/createInvoice): Create an invoice for the specified organization.
  - [Create an invoice from a quote.](/openapi/createInvoiceFromQuote): Generate a draft invoice by copying the lines of an accepted quote.
  - [Create or update a notification subscription.](/openapi/createNotificationSubscription): Set the notification level for a subject for the authenticated member.
  - [Take in a sales order.](/openapi/createOrder): Create an order from a webshop or other channel. The buyer is matched on email or created, lines are matched to variants by id, SKU, or EAN, and a promotion code is applied to the whole order. Posting the same `source` and `externalId` again returns the existing order with status 200 instead of creating a second one. Set `confirm` to reserve stock right away.
  - [Create a new organization for the authenticated user.](/openapi/createOrganization): Create an organization, assign the current user as owner, and return the created organization.
  - [Create an organization audit export.](/openapi/createOrganizationAuditExport): Queue an asynchronous CSV export of redacted organization audit events. Restricted details cannot be requested through this endpoint.
  - [Create a product.](/openapi/createProduct): Create a product for the specified organization.
  - [Create a product category.](/openapi/createProductCategory): Create a product category for the specified organization.
  - [Create a purchase order.](/openapi/createPurchaseOrder): Create a draft purchase order for a supplier. Sending and emailing it happens in the app.
  - [Create a quote.](/openapi/createQuote): Create a quote for the specified organization.
  - [Create a supplier.](/openapi/createSupplier): Create a supplier for an organization.
  - [Create a tag.](/openapi/createTag): Create a tag for the specified organization.
  - [Create a task.](/openapi/createTask): Create a task for the specified organization.
  - [Create a team.](/openapi/createTeam): Create a team for the specified organization.
  - [Create a template.](/openapi/createTemplate): Create a reusable quote, invoice, or task template for the specified organization.
  - [Log time.](/openapi/createTimeEntry): Create a time entry. Entries in a submitted or approved timesheet week are rejected.
  - [Request time off.](/openapi/createTimeOffRequest): Create a time-off request in hours. It is routed to the employee's manager for approval.
  - [Create a webhook destination.](/openapi/createWebhookDestination): Create an HTTPS destination for outgoing webhook events. The signing secret is returned only by this operation or an explicit rotation.
  - [Create a webhook endpoint.](/openapi/createWebhookEndpoint): Create an incoming webhook endpoint. The signing secret is returned only by this operation or an explicit rotation.
  - [Decide approvals.](/openapi/decideApprovals): Approve or reject up to 100 pending approvals at once. Each approval succeeds or fails on its own.
  - [Decide a workflow approval.](/openapi/decideWorkflowRunApproval): Approve or deny the approval step a workflow run is waiting on. Who may decide follows the approval request: its named approvers, holders of its approver permission, or their delegates. Requesters cannot approve their own authorize requests. With several approvers required, the run resumes once enough have approved.
  - [Delete an agenda item.](/openapi/deleteAgendaItem): Delete an agenda series or one recurring occurrence from an editable calendar.
  - [Delete a brand.](/openapi/deleteBrand): Delete a brand for the specified organization.
  - [Delete a customer.](/openapi/deleteCustomer): Delete a customer for the specified organization.
  - [Delete a customer asset.](/openapi/deleteCustomerAsset): Delete a customer asset for the specified organization.
  - [Delete a customer asset note.](/openapi/deleteCustomerAssetNote): Delete an internal note from a customer asset.
  - [Delete a customer note.](/openapi/deleteCustomerNote): Delete a note from a customer timeline.
  - [Delete an invoice.](/openapi/deleteInvoice): Archive an invoice for the specified organization.
  - [Delete an invoice note.](/openapi/deleteInvoiceNote): Delete an internal note from an invoice.
  - [Delete a notification subscription.](/openapi/deleteNotificationSubscription): Stop watching a subject for the authenticated member.
  - [Delete a single organization.](/openapi/deleteOrganization): Delete the specified organization when the authenticated user is allowed to remove it.
  - [Delete a product.](/openapi/deleteProduct): Delete a product for the specified organization.
  - [Delete a product category.](/openapi/deleteProductCategory): Delete a product category for the specified organization.
  - [Delete a quote.](/openapi/deleteQuote): Archive a quote for the specified organization.
  - [Delete a quote note.](/openapi/deleteQuoteNote): Delete an internal note from a quote.
  - [Delete a supplier.](/openapi/deleteSupplier): Delete a supplier for the specified organization.
  - [Delete a tag.](/openapi/deleteTag): Delete a tag for the specified organization.
  - [Delete a task.](/openapi/deleteTask): Delete a task for the specified organization.
  - [Delete a task comment.](/openapi/deleteTaskComment): Delete a comment from a task.
  - [Delete a task time entry.](/openapi/deleteTaskTimeEntry): Delete a time entry from a task.
  - [Delete a team.](/openapi/deleteTeam): Delete a team for the specified organization.
  - [Delete a template.](/openapi/deleteTemplate): Delete a reusable quote or invoice template for the specified organization.
  - [Delete a webhook destination.](/openapi/deleteWebhookDestination): Permanently delete an outgoing webhook destination.
  - [Delete a webhook endpoint.](/openapi/deleteWebhookEndpoint): Permanently delete an incoming webhook endpoint.
  - [Download an inbox attachment.](/openapi/downloadInboxAttachment)
  - [Download a public calendar feed by token.](/openapi/downloadPublicCalendarFeed): Returns an iCalendar feed through a bearer-token public link.
  - [Download a public shared file by token.](/openapi/downloadPublicSharedFile): Redirects a valid bearer-token file link to its signed download URL.
  - [Download a team leave feed by token.](/openapi/downloadPublicTimeOffFeed): Returns approved team leave as an iCalendar feed through a private token link. Access is revalidated on every fetch and sick-leave reasons are hidden.
  - [Duplicate an invoice.](/openapi/duplicateInvoice): Create a new draft invoice copied from an existing one.
  - [Duplicate a quote.](/openapi/duplicateQuote): Duplicate a quote as a new editable version.
  - [Finalize a direct resumable Files upload.](/openapi/finalizeFileUpload): Verify the uploaded Storage object, its byte size, and detectable file signature before atomically creating the Files node version.
  - [Generate inbox reply suggestions.](/openapi/generateInboxSuggestions)
  - [Get an agenda item.](/openapi/getAgendaItem): Return one agenda item the authenticated user can view.
  - [Versioned health check for the API app.](/openapi/getApiHealthV1): Return the versioned health status for the API app.
  - [Get a brand.](/openapi/getBrand): Return a brand for the specified organization.
  - [Get the current authenticated user.](/openapi/getCurrentUser): Return the currently authenticated user for the active request. Accepts a bearer token for API clients while continuing to support the current browser session.
  - [Get a customer.](/openapi/getCustomer): Return a customer detail record for the specified organization.
  - [Get a customer asset.](/openapi/getCustomerAsset): Return a customer asset for the specified organization.
  - [Get a customer contact.](/openapi/getCustomerContact): Return a linked contact for a customer.
  - [Get a customer location.](/openapi/getCustomerLocation): Return a customer location.
  - [Get an employee.](/openapi/getEmployee): Return one employee. Private details are never included.
  - [Get a Files node.](/openapi/getFileNode): Returns safe file or folder metadata after authoritative inherited node access checks.
  - [Get a Files ZIP export.](/openapi/getFileZipExport): Poll an asynchronous ZIP job. Ready jobs include a short-lived signed URL only for the authorized requester.
  - [Get inbox delivery status.](/openapi/getInboxDelivery)
  - [Get an invitation.](/openapi/getInvitation): Return detail for an organization invitation.
  - [Get an invoice.](/openapi/getInvoice): Return an invoice detail record for the specified organization.
  - [Read a invoice lifecycle.](/openapi/getInvoiceLifecycle): The invoice's lifecycle: the pinned workflow version, the current stage, the stage history, and what the lifecycle waits on now. `lifecycle` is null when no lifecycle run started for the invoice.
  - [Get an organization member.](/openapi/getMember): Return detail for a member in the specified organization.
  - [Get the composed notification inbox.](/openapi/getNotificationInbox): Return the mixed attention inbox for the authenticated member, including live running work and pending invitations.
  - [Get a sales order.](/openapi/getOrder): Return one sales order with its lines, fulfillment and payment progress.
  - [Read an order lifecycle.](/openapi/getOrderLifecycle): The order's lifecycle: the pinned workflow version, the current stage, the stage history, and what the lifecycle waits on now. `lifecycle` is null when no lifecycle run started for the order.
  - [Get an organization audit export.](/openapi/getOrganizationAuditExport): Return one export job owned by the authenticated requester. A five-minute download URL is included only while a completed export remains available.
  - [Get a single organization available to the authenticated user.](/openapi/getOrganizationById): Return the organization identified by the provided ID when the authenticated user can access it.
  - [Get a product.](/openapi/getProduct): Return a product for the specified organization.
  - [Get a product category.](/openapi/getProductCategory): Return a product category for the specified organization.
  - [Read a new-hire pre-boarding page.](/openapi/getPublicPreboardingPage): Returns the organization, start date, and requested documents for a pre-boarding token link. Expired, revoked, and already-linked links return 404.
  - [Get a purchase order.](/openapi/getPurchaseOrder): Return one purchase order with its lines and what was received so far.
  - [Get a quote.](/openapi/getQuote): Return a quote detail record for the specified organization.
  - [Read a quote lifecycle.](/openapi/getQuoteLifecycle): The quote's lifecycle: the pinned workflow version, the current stage, the stage history, and what the lifecycle waits on now. `lifecycle` is null when no lifecycle run started for the quote.
  - [Get a shipment.](/openapi/getShipment): Return one shipment with its lines, carrier, and tracking details.
  - [Get a supplier.](/openapi/getSupplier): Return a supplier for the specified organization.
  - [Get a tag.](/openapi/getTag): Return a tag for the specified organization.
  - [Get a task.](/openapi/getTask): Return task detail for the specified organization.
  - [Read a task lifecycle.](/openapi/getTaskLifecycle): The task's lifecycle: the pinned workflow version, the current stage, the stage history, and what the lifecycle waits on now. `lifecycle` is null when no lifecycle run started for the task.
  - [Get a team.](/openapi/getTeam): Return a team detail record for the specified organization.
  - [Get a template.](/openapi/getTemplate): Return a template detail record for the specified organization.
  - [Get a webhook delivery.](/openapi/getWebhookDelivery): Return one outgoing webhook delivery attempt and its observed response.
  - [Get a webhook destination.](/openapi/getWebhookDestination): Return an outgoing webhook destination without its signing secret.
  - [Get a webhook endpoint.](/openapi/getWebhookEndpoint): Return an incoming webhook endpoint without its signing secret.
  - [Get a workflow definition.](/openapi/getWorkflowDefinition): Return a summary of one published workflow definition available to the authenticated organization user. The visual graph and draft content are never returned.
  - [Get a workflow run.](/openapi/getWorkflowRun): Return one organization workflow run with execution steps and observed input, output, and errors. The graph snapshot is never returned.
  - [Invite a user.](/openapi/inviteUser): Create an invitation and dispatch the invite email.
  - [List agenda items.](/openapi/listAgendaItems): Return agenda items that overlap the requested range and match the optional filters.
  - [List brands.](/openapi/listBrands): Return brands for an organization the authenticated user can access.
  - [List chat messages.](/openapi/listChatMessages): Return a latest-relative page of messages. Offset zero is the newest window; each page is chronological and increasing offsets retrieve older windows.
  - [List customer asset notes.](/openapi/listCustomerAssetNotes): Return internal notes for a customer asset.
  - [List customer assets.](/openapi/listCustomerAssets): Return customer assets for an organization.
  - [List customers.](/openapi/listCustomers): Return customers for an organization the authenticated user can access.
  - [List employees.](/openapi/listEmployees): Return employees, contractors, and interns for an organization. Private details are never included.
  - [List expense claims.](/openapi/listExpenses): Return expense claims for a scope: the caller's own, everything, awaiting the caller's approval, or ready to reimburse.
  - [List accessible Files drives.](/openapi/listFileDrives): Returns company, customer, personal, and shared drives visible to the caller through inherited Files access.
  - [List Files node children.](/openapi/listFileNodeChildren): Returns an authorized page of direct children for a folder, including explicitly requested trash visibility.
  - [List applications for a job.](/openapi/listHiringApplications): Return candidate applications for a job with their current stage and average rating.
  - [List jobs.](/openapi/listHiringJobs): Return hiring jobs (vacancies) for an organization.
  - [List inbox thread messages.](/openapi/listInboxThreadMessages)
  - [List inbox threads.](/openapi/listInboxThreads)
  - [List inventory allocations.](/openapi/listInventoryAllocations): Return stock reserved or consumed by quotes, tasks, and invoices.
  - [List stock levels per variant.](/openapi/listInventoryLevels): Return on hand, reserved, available, backordered, and incoming quantities for every stock-tracked variant, for webshop stock sync. Subscribe to the `inventory.level-changed` webhook to hear about changes.
  - [List inventory locations.](/openapi/listInventoryLocations): Return inventory locations for an organization.
  - [List inventory movements.](/openapi/listInventoryMovements): Return inventory movement history for an organization.
  - [List inventory stock records.](/openapi/listInventoryStockRecords): Return inventory stock records for an organization, optionally filtered by product.
  - [List invitations.](/openapi/listInvitations): Return pending and historical invitations for an organization.
  - [List invoice notes.](/openapi/listInvoiceNotes): Return internal notes for an invoice.
  - [List invoices.](/openapi/listInvoices): Return invoices for an organization the authenticated user can access.
  - [List organization members.](/openapi/listMembers): Return members for an organization the authenticated user can access.
  - [List notification preferences.](/openapi/listNotificationPreferences): Return account and organization channel preferences for the authenticated member.
  - [List notifications.](/openapi/listNotifications): Return paginated in-app notifications for the authenticated member of an organization.
  - [List notification subscriptions.](/openapi/listNotificationSubscriptions): Return notification levels for the authenticated member.
  - [List sales orders.](/openapi/listOrders): Return sales orders, newest first. Search matches the order number, external id, and buyer name.
  - [List organization audit events.](/openapi/listOrganizationAuditEvents): Return a cursor-capable page of redacted organization audit event summaries. Restricted details and sensitive metadata are never returned.
  - [List the organizations available to the authenticated user.](/openapi/listOrganizations): Return the organizations the authenticated user can access, ordered by recent usage.
  - [List my pending approvals.](/openapi/listPendingApprovals): Return time-off requests, timesheets, and expense claims waiting for the caller's decision, including delegated ones.
  - [List product categories.](/openapi/listProductCategories): Return product categories for an organization.
  - [List products.](/openapi/listProducts): Return products for an organization the authenticated user can access.
  - [List purchase orders.](/openapi/listPurchaseOrders): Return purchase orders to suppliers, newest first.
  - [List quote notes.](/openapi/listQuoteNotes): Return internal notes for a quote.
  - [List quotes.](/openapi/listQuotes): Return quotes for an organization the authenticated user can access.
  - [List shipments.](/openapi/listShipments): Return outbound deliveries, inbound receipts, and returns, filtered by order or purchase order.
  - [List suppliers.](/openapi/listSuppliers): Return suppliers for an organization.
  - [List tags.](/openapi/listTags): Return tags for an organization, optionally filtered by kind.
  - [List task comments.](/openapi/listTaskComments): Return comments for a task.
  - [List tasks.](/openapi/listTasks): Return tasks for an organization the authenticated user can access.
  - [List task time entries.](/openapi/listTaskTimeEntries): Return time entries for a task.
  - [List teams.](/openapi/listTeams): Return teams for an organization the authenticated user can access.
  - [List templates.](/openapi/listTemplates): Return quote, invoice, and task templates for an organization the authenticated user can access.
  - [List time entries.](/openapi/listTimeEntries): Return logged time for tasks, customers, and internal work.
  - [List time-off requests.](/openapi/listTimeOffRequests): Return time-off requests visible to the caller: their own, their reports', or everyone's for HR.
  - [List webhook deliveries.](/openapi/listWebhookDeliveries): Return paginated delivery attempts, optionally filtered by destination.
  - [List webhook destinations.](/openapi/listWebhookDestinations): Return outgoing webhook destinations without their signing secrets.
  - [List webhook endpoints.](/openapi/listWebhookEndpoints): Return incoming webhook endpoints without their signing secrets.
  - [List workflow definitions.](/openapi/listWorkflowDefinitions): Return paginated summaries of published workflow definitions available to the authenticated organization user. Draft graphs and editor metadata are never returned.
  - [List workflow runs.](/openapi/listWorkflowRuns): Return paginated organization workflow runs, optionally filtered by definition version, workflow key (every version), status, or trigger kind. Graph snapshots are never returned.
  - [Log in with email and password.](/openapi/loginWithPassword): Exchange an email and password for an authenticated session.
  - [Log out the current session.](/openapi/logoutCurrentSession): Clear the active authenticated session for the current requester.
  - [Mark all notifications read.](/openapi/markAllNotificationsRead): Mark every unread notification in the current organization as read for the authenticated member.
  - [Mark an invoice paid.](/openapi/markInvoicePaid): Transition a sent or overdue invoice to paid.
  - [Move an agenda item.](/openapi/moveAgendaItem): Move or resize an agenda item or one recurring occurrence in an editable calendar.
  - [Move a product category.](/openapi/moveProductCategory): Move a product category to a new parent and position.
  - [Update a notification.](/openapi/patchNotification): Mark a notification read, unread, or dismissed for the authenticated member.
  - [Pause invoice reminders.](/openapi/pauseInvoiceReminders): Stops payment reminders on the invoice, for example while a dispute or payment plan runs. With `until`, reminders resume on that date.
  - [Publish a workflow.](/openapi/publishWorkflowDefinition): Publish an organization workflow draft as the next live version. Earlier published versions of the same key are archived and their schedules removed; access grants and watchers carry over. Invalid graphs are rejected.
  - [Upsert a notification preference.](/openapi/putNotificationPreference): Create or update a channel preference for the authenticated member.
  - [Read a public shared chat by token.](/openapi/readPublicSharedChat): Returns a paginated read-only chat through a bearer-token public link.
  - [Receive an incoming organization webhook.](/openapi/receivePublicWebhook): Accepts a public token URL, verifies the HMAC-SHA256 signature (`x-centrakit-signature` over `{timestamp}.{body}` within five minutes) or the shared secret header, and starts matching workflows. Bodies over 256 KB are rejected.
  - [Receive purchase order lines.](/openapi/receivePurchaseOrder): Book received quantities into stock. Average cost updates and waiting backorders are filled. Returns 409 `APPROVAL_REQUIRED` with an `approvalId` when an approval policy wants a decision first.
  - [Record an invoice payment.](/openapi/recordInvoicePayment): Records a manual payment (bank transfer, cash, card, or other) against a sent or overdue invoice. Partial payments keep the invoice open; the payment that settles the balance marks it paid.
  - [Reject a quote.](/openapi/rejectQuote): Mark a quote rejected from the authenticated organization context.
  - [Remove a customer contact.](/openapi/removeCustomerContact): Remove a linked contact from a customer.
  - [Remove a customer location.](/openapi/removeCustomerLocation): Remove a customer location.
  - [Remove a brand image from the organization gallery.](/openapi/removeOrganizationBrandImage): Delete a stored brand image.
  - [Remove the organization logo.](/openapi/removeOrganizationLogo): Remove the organization logo from storage.
  - [Remove a product supplier link.](/openapi/removeProductSupplierLink): Remove a supplier link from a product.
  - [Reorder tasks.](/openapi/reorderTasks): Reorder task board items for the specified organization.
  - [Replace team members.](/openapi/replaceTeamMembers): Replace all members assigned to a team.
  - [Request a password reset email.](/openapi/requestPasswordReset): Start the password recovery flow by sending a recovery email to the provided address.
  - [Request changes to a quote.](/openapi/requestPortalQuoteChanges): The customer asks for changes to the sent quote from the portal page. The quote moves to Changes requested, its reminders stop, and the team is notified. Guests can call this; the quote must be published and still open.
  - [Resume invoice reminders.](/openapi/resumeInvoiceReminders): Resumes payment reminders that were paused on the invoice.
  - [Retrieve organization knowledge.](/openapi/retrieveKnowledge): Search authorized organization and system knowledge and return matching text chunks with public provenance. Internal embeddings, vector data, service metadata, and storage paths are never returned.
  - [Revoke an invitation.](/openapi/revokeInvitation): Revoke a pending organization invitation.
  - [Rotate a webhook destination signing secret.](/openapi/rotateWebhookDestinationSecret): Replace the signing secret used for outgoing webhook deliveries. The new secret is returned only once.
  - [Rotate a webhook endpoint signing secret.](/openapi/rotateWebhookEndpointSecret): Replace the signing secret for an incoming webhook endpoint. The new secret is returned only once.
  - [Rotate a webhook endpoint token.](/openapi/rotateWebhookEndpointToken): Replace the public receiver token for an incoming webhook endpoint, invalidating the previous URL.
  - [Search collaboration references.](/openapi/searchCollaborationReferences)
  - [Search records available to the command center.](/openapi/searchCommandCenterRecords): Search authorized organization, customer portal, or platform administration records.
  - [Send a staff reply to an inbox thread.](/openapi/sendInboxThreadReply)
  - [Send an invoice.](/openapi/sendInvoice): Transition a draft invoice to sent, creating its Stripe payment option and public link.
  - [Send a quote.](/openapi/sendQuote): Transition a draft quote to sent.
  - [Set the active organization preference for the authenticated user.](/openapi/setActiveOrganization): Store the preferred active organization on the current user's profile. This helps clients choose a default organization when no explicit organization id is supplied on a request, but it does not replace per-request membership checks or authorization.
  - [Set primary customer contact.](/openapi/setPrimaryCustomerContact): Mark a linked contact as the customer primary contact.
  - [Set primary customer location.](/openapi/setPrimaryCustomerLocation): Mark a location as the customer's primary location.
  - [Set quote asset links.](/openapi/setQuoteAssets): Replace the customer assets linked to a quote.
  - [Set quote task links.](/openapi/setQuoteTasks): Replace the tasks linked to a quote.
  - [Set task assignees.](/openapi/setTaskAssignees): Replace the users assigned to a task.
  - [Set task status.](/openapi/setTaskStatus): Move a task to a status and board position.
  - [Ship a shipment.](/openapi/shipShipment): Mark an outbound shipment as shipped: stock leaves the warehouse and the order's fulfillment progresses. Returns 409 `APPROVAL_REQUIRED` with an `approvalId` when an approval policy wants a decision first.
  - [Sign up with email and password.](/openapi/signUpWithPassword): Create a user account and start the standard confirmation flow.
  - [Start Google Calendar OAuth.](/openapi/startGoogleCalendarOAuth): Authorize an organization integration through Vercel Connect.
  - [Start an OAuth provider flow.](/openapi/startOAuthFlow): Create the provider authorization URL for an OAuth sign-in flow.
  - [Start a workflow run.](/openapi/startWorkflowRun): Start a published organization workflow that declares a valid manual trigger. Reusing an idempotency key returns the original organization run.
  - [Submit new-hire private details.](/openapi/submitPublicPreboardingDetails): Saves the new hire's private details (birth date, contact, bank account, emergency contact, address) through a pre-boarding token link and completes the pre-boarding form step.
  - [Update an agenda item.](/openapi/updateAgendaItem): Replace an agenda item or one recurring occurrence in an editable calendar.
  - [Update a brand.](/openapi/updateBrand): Update a brand for the specified organization.
  - [Update a customer.](/openapi/updateCustomer): Update a customer for the specified organization.
  - [Update a customer asset.](/openapi/updateCustomerAsset): Update a customer asset for the specified organization.
  - [Update a customer asset note.](/openapi/updateCustomerAssetNote): Update an internal note on a customer asset.
  - [Update a customer contact.](/openapi/updateCustomerContact): Update a linked contact for a customer.
  - [Update a customer location.](/openapi/updateCustomerLocation): Update a customer location.
  - [Update a customer note.](/openapi/updateCustomerNote): Update a note on a customer timeline.
  - [Update an employee.](/openapi/updateEmployee): Update employment fields such as job title, department, manager, and status.
  - [Update an inventory stock record.](/openapi/updateInventoryStockRecord): Update an inventory stock record for a product.
  - [Update an invitation.](/openapi/updateInvitation): Update a pending organization invitation.
  - [Update an invoice.](/openapi/updateInvoice): Update an invoice for the specified organization.
  - [Update an invoice note.](/openapi/updateInvoiceNote): Update an internal note on an invoice.
  - [Update a member role.](/openapi/updateMemberRole): Update the role assigned to an organization member.
  - [Update a single organization.](/openapi/updateOrganization): Update the settings for the specified organization when the authenticated user has permission.
  - [Update the current user's password.](/openapi/updatePassword): Update the password for the active authenticated session, including recovery sessions established through the password reset flow.
  - [Update a product.](/openapi/updateProduct): Update a product for the specified organization.
  - [Update a product category.](/openapi/updateProductCategory): Update a product category for the specified organization.
  - [Update a product supplier link.](/openapi/updateProductSupplierLink): Update ordering details for a product supplier link.
  - [Update a quote.](/openapi/updateQuote): Update a quote for the specified organization.
  - [Update a quote note.](/openapi/updateQuoteNote): Update an internal note on a quote.
  - [Update a supplier.](/openapi/updateSupplier): Update a supplier for the specified organization.
  - [Update a tag.](/openapi/updateTag): Update a tag for the specified organization.
  - [Update a task.](/openapi/updateTask): Update a task for the specified organization.
  - [Update a task comment.](/openapi/updateTaskComment): Update a comment on a task.
  - [Update a team.](/openapi/updateTeam): Update a team for the specified organization.
  - [Update a template.](/openapi/updateTemplate): Update a reusable quote or invoice template for the specified organization.
  - [Update a webhook destination.](/openapi/updateWebhookDestination): Update the name, URL, event subscriptions, or enabled state of an outgoing webhook destination.
  - [Update a webhook endpoint.](/openapi/updateWebhookEndpoint): Update the name, workflow binding, or enabled state of an incoming webhook endpoint.
  - [Upload an inbox attachment.](/openapi/uploadInboxAttachment)
  - [Upload a brand image to the organization gallery.](/openapi/uploadOrganizationBrandImage): Upload a PNG, JPEG, or WebP brand image. The server normalizes the image, strips EXIF metadata, and stores one standardized WebP image for rendering. Organizations are capped at 12 brand images.
  - [Upload the organization logo.](/openapi/uploadOrganizationLogo): Upload a PNG, JPEG, or WebP file to replace the organization logo. The server normalizes the image, strips EXIF metadata, and stores one standardized WebP image for rendering.
  - [Upload a requested pre-boarding document.](/openapi/uploadPublicPreboardingDocument): Uploads a document the new hire was asked for (multipart form with `itemId` and `file`, at most 20 MB) through a pre-boarding token link and completes that checklist step.
  - [Validate a promotion.](/openapi/validatePromotion): Check whether a promotion or code can be used by a customer on a quote, order, or invoice, without redeeming it. Pass the subtotal and quantity to check minimums.
  - [Write off an invoice.](/openapi/writeOffInvoice): Marks a sent or overdue invoice uncollectible. Reminders stop and the open balance no longer counts as receivable.
- Architecture
  - [Monorepo](/architecture/monorepo): CentraKit Turborepo app and package topology.
  - [Bundling and file tracing](/architecture/bundling-and-file-tracing): Keep runtime assets available in Next.js and Workflow server bundles.
  - [Service Layers](/architecture/service-layers): Data contracts, Supabase implementations, request containers, and Result-based domain flows.
  - [Tenancy](/architecture/tenancy): URL-based organization tenancy, slug extraction, access guards, and tenant navigation.
  - [RBAC](/architecture/rbac): Role defaults, typed permissions, per-organization overrides, JWT hints, and enforcement layers.
  - [Audit Logs](/architecture/audit-logs): Immutable semantic security events, access boundaries, retention, and export workflows.
  - [Authentication](/architecture/authentication): Supabase Auth ownership, session posture, OAuth linking, and deferred controls.
  - [Cache Components And Streaming](/architecture/cache-components-and-streaming): Next.js static shells, Suspense islands, access gates, and cache tag conventions.
  - [Internationalization](/architecture/i18n): next-intl extraction, locale routing, gettext catalogs, and translation rules.
  - [Supabase Schema](/architecture/supabase-schema): Declarative schema workflow, generated migrations, RLS placement, seeds, and generated types.
- Operations
  - [CI And Release](/operations/ci-and-release): GitHub Actions workflows, branch protection, verification jobs, and CLI release flow.
  - [Stripe Billing](/operations/stripe-billing): Stripe Billing and customer-invoice payment surfaces, environment variables, Connect setup, webhooks, and go-live checks.
  - [Workflows](/operations/workflows): Inspect durable graph runs for quote, invoice, task, agenda, and scheduled system automations.
  - [Supabase Local Dev](/operations/supabase-local-dev): Local Supabase startup, sync, reset, seeds, storage, and generated types.
  - [Environment Variables](/operations/environment-variables): Root env files, Vercel env management, Supabase values, Stripe values, and Turbo task env forwarding.
  - [Vercel metrics pass](/operations/vercel-metrics-pass): How to run a metrics-first vercel-optimize / CDN + PPR health check for CentraKit apps.
- Admin
  - [Operations dashboard](/admin/dashboard): The system admin landing page at /admin that summarizes tenants, subscriptions, revenue, failed payments, usage anomalies and operational failures across the platform.
  - [Users](/admin/users): How system administrators list, invite, edit, disable, ban and delete platform users, and assign system and organization roles, under /admin/users.
  - [Organizations](/admin/organizations): How system administrators list, create, edit, disable and delete tenant organizations under /admin/organizations.
  - [Roles and permissions](/admin/roles-and-permissions): How system administrators manage built-in and global roles, edit permission titles, and set platform approval rules under /admin/roles.
  - [AI settings](/admin/ai-settings): How system administrators enable AI Gateway models, pick default models per use case, edit per-function instructions, and set the agent policy and runtime defaults under /admin/ai.
  - [Knowledge](/admin/knowledge): How system administrators manage platform-wide knowledge collections under /admin/knowledge, and how ingestion and hybrid retrieval work for AI chat.
  - [Plans](/admin/plans): How system administrators review the Starter, Pro, Business and Enterprise plan catalog, edit credit package prices, and publish prices to Stripe under /admin/plans.
  - [Billing](/admin/billing): How system administrators review and change organization subscriptions, manage subscription invoices, download invoice PDFs and refresh billing from Stripe under /admin/subscriptions and /admin/invoices.
  - [Workflows](/admin/workflows): How system administrators manage the system automations and record lifecycles that apply to every organization under /admin/workflows, including versions, default lifecycles and run history.
  - [Analytics](/admin/analytics): The cross-organization business analytics page at /admin/analytics, with platform KPIs, deterministic forecasts, rule-based insights and source data exports for system administrators.
  - [Integrations](/admin/integrations): How system administrators manage the integration marketplace catalog under /admin/integrations, including availability, install scopes, categories, logos and resource links.
  - [Feature flags](/admin/feature-flags): The status of the system admin feature flags page at /admin/feature-flags, which is a placeholder and does not manage flags yet.
  - [Platform settings](/admin/platform-settings): How system administrators configure the customer invoice platform fee, the inbound email domain and route distance services at /admin/settings, and how platform settings are stored.
  - [Audit log](/admin/audit-log): How system administrators search platform-wide audit events, inspect event details, reveal restricted fields and export events as CSV under /admin/audit-log.
- Decisions
  - [Architecture decision records](/decisions/README): Why CentraKit differs from the shared repo standard, and which migrations are deferred.
  - [0000: Template](/decisions/0000-template): Copy this file to record a new decision.
  - [0001: Next.js route handlers for the API and MCP](/decisions/0001-next-route-handlers-for-api-and-mcp): The REST API and MCP server stay as Next.js route handlers in apps/api instead of Hono, oRPC, and a separate apps/mcp.
  - [0002: Bounded package topology](/decisions/0002-bounded-package-topology): Domain logic stays split into bounded contract, core, and supabase packages instead of domain, contract, and services.
  - [0003: The apps/saas name and host-based routing](/decisions/0003-saas-app-name-and-host-routing): The product app stays apps/saas, and every surface is served from its own subdomain instead of path prefixes.
  - [0004: Zod until the API layer migration](/decisions/0004-zod-until-api-layer-migration): Zod 4 stays the single schema library until the API layer moves to oRPC.
  - [0005: Audit log naming](/decisions/0005-audit-log-naming): The audit log keeps the audit_logs table family and capture_audit_log_row() instead of audit_events and audit_row_change().
  - [0006: Env file layout](/decisions/0006-env-file-layout): pnpm env:pull writes development values to .env.local so .env.development.local can hold local Supabase overrides.
  - [0007: Deferred better-supabase and PermDock](/decisions/0007-deferred-better-supabase-and-permdock): The hand-written Supabase packages and the custom RBAC stay until dedicated migration plans.
  - [0008: CLI on citty, clack and c12](/decisions/0008-cli-unjs-stack): The centrakit CLI moves from commander and hand-written helpers to citty, @clack/prompts, c12 and Node 24 built-ins, and the guard tests scan files with fs.glob and oxc-parser.
- Agent notes
  - [Agent notes](/agents/README): Things coding agents get wrong in CentraKit, grouped by topic.
  - [Toolchain](/agents/toolchain): pnpm, TypeScript 7, Oxlint and Oxfmt mistakes to avoid.
  - [Git and releases](/agents/git-and-release): Branches, commit messages, hooks and Changesets.
  - [Supabase schema](/agents/supabase-schema): Declarative schema files, ordering, migrations and audit triggers.
  - [Tenancy and routing](/agents/tenancy-and-routing): Organization slugs, synchronous page shells and Suspense islands.
  - [Translations](/agents/translations): The .po catalogs and extracted messages.
  - [Testing](/agents/testing): Where tests live and how they resolve paths.
  - [Writing docs](/agents/writing-docs): How to write and update pages in the public docs so they match the shipped product.
- Changelog
  - [Changelog](/changelog): Product releases for CentraKit across every app.
  - [SaaS Changelog](/changelog/saas): Release notes for the CentraKit SaaS web application.
  - [API Changelog](/changelog/api): Release notes for the CentraKit REST and MCP API.