The API is a single FastAPI service. The web app at app.rmsautomation.ai is a client of it and has no privileged path of its own. Anything the interface can do, a request can do.
https://api.rmsautomation.ai
All request and response bodies are application/json, except where an endpoint returns a generated document, in which case the response is the file itself with the matching Content-Type. Every path below is relative to the base URL.
Three surfaces#
The endpoints divide into three groups that behave differently enough to be worth separating up front.
| Surface | Prefix | Character |
|---|---|---|
| Database | /db/* | Ordinary CRUD over stored records. Fast, deterministic, safe to retry on a timeout for reads. |
| Documents | /reports/*, /ai/*, /forms/* | Generation. A single call holds the connection for 30–60 seconds and returns a finished PDF, XLSX or DOCX. Not idempotent. |
| Operations | /jobs, /time, /billing/*, /enterprise/* | Scheduling, timesheets, subscription state, roles and audit history. |
Document endpoints do real work: a NETA report renders every asset, and several call a language model. The default timeout in most HTTP clients is shorter than that, so the first symptom of a correct integration is usually a client-side timeout on a request the server went on to complete successfully. Allow at least 90 seconds on /reports/generate, /ai/* and /forms/scan.
Browser clients#
CORS is an explicit allow-list, not a wildcard. A browser-based integration on your own domain needs that origin added, support@rmsautomation.ai. Server-side clients are unaffected, and are the better choice anyway: putting a token in a page ships it to every visitor.