Email sign-up at /app/api/auth/sign-up/email requires an x-turnstile-token header in production. Failed or unavailable bot verification returns 403 with code BOT_CHECK_REQUIRED. Social sign-up is unaffected. Documents in. Verified data out.
The public REST API (v1) turns documents (invoices, receipts, purchase orders, bank statements, delivery notes, or custom schemas) into structured, verified data. Every document reaches an explicit terminal state. Every extracted table row is accounted for. Money fields are cross-checked (crossfooting). Bank statements are balance-checked. Every field links back to its source in the document.
Unsupported methods on registered API paths return an empty 405 Method Not Allowed response with an Allow header listing supported methods. HEAD is supported wherever GET is registered; OPTIONS keeps its existing preflight behavior. Unknown paths remain 404. Maintenance and canonical-host redirects still take precedence.