API documentation

TM7 Ready exposes a small set of public HTTP APIs for health checks, immigration office lookup, and wizard order creation. Machine-readable OpenAPI and an RFC 9727 API catalog are also published.

Discovery

API catalog (application/linkset+json)
OpenAPI 3.1 specification
Health endpoint

Endpoints

GET /api/health — liveness ({ "status": "ok" })
GET /api/offices — rank immigration offices (province, optional lat/lng)
POST /api/orders — create a draft order from wizard answers; sets an HttpOnly order cookie
POST /api/checkout — create a Stripe Checkout session (requires order cookie)
GET /api/orders/{orderId}/status — poll fulfillment status after payment

Authentication

Customer APIs use per-order HttpOnly cookies, not OAuth. Admin and cron routes are not part of this public catalog.

Limits

Rate limits apply per client IP. In production, mutating POST requests require a same-origin Origin or Referer header.