# PocketPapi

PocketPapi is a centralized command center for managing connected websites, tasks, agents, support, SEO, performance, and approvals.

Machine interfaces:
- REST discovery: /.well-known/ai-plugin.json
- REST status: /api/control-plane/status
- REST projects: /api/control-plane/projects
- REST sites: /api/control-plane/sites
- REST EasyApp status: /api/control-plane/easyapp
- REST EasyApp ensure: POST /api/control-plane/easyapp (site-scoped, idempotent)
- REST synchronization health: /api/control-plane/sync-health
- REST tasks: /api/control-plane/tasks
- REST activity: /api/control-plane/activity
- REST reviews: /api/control-plane/reviews?site_id=123
- REST conversations: /api/control-plane/conversations?site_id=123
- REST messages: /api/control-plane/messages?conversation_id=123
- REST support tickets: /api/control-plane/tickets?site_id=123
- REST ticket messages: /api/control-plane/ticket-messages?ticket_id=123
- REST reply to review: POST /api/control-plane/reviews/reply
- REST reply to conversation: POST /api/control-plane/messages/reply
- REST sender profiles: GET/POST /api/control-plane/mail/profiles
- REST BIMI status/prepare/verify/record: /api/control-plane/bimi/*
- REST ingest: POST /api/control-plane/events (message, subscription, contact, or lead)
- EasyApp public site directory: GET /api/easyapp/sites
- EasyApp private enrollment: POST /api/easyapp/configure
- EasyApp site login: POST /api/easyapp/auth/login
- EasyApp leads: GET /api/easyapp/leads; POST /api/easyapp/leads/status
- EasyApp live chat: GET /api/easyapp/conversations, GET /api/easyapp/messages, POST /api/easyapp/messages/reply
- PocketPapi mobile login: POST /api/command-center/auth/login
- PocketPapi mobile data: GET /api/command-center/summary, /projects, /sites, /tasks, /activity, /integration-logs (administrator troubleshooting permission)
- MCP JSON-RPC: /mcp
- Complete API guide: /api/control-plane/guide
- Central Zernio gateway: /api/control-plane/zernio/accounts, /api/control-plane/zernio/reviews, /api/control-plane/zernio/posts
- Public effects library: /help/effects (63 recipes, including advanced native recipes and eight free MIT library starters)
- Public effects catalog: GET /api/effects, GET /api/effects/{effect_id}, POST /api/effects/compose
- MCP effects tools: sitecommander_effects_search, sitecommander_effects_fetch, sitecommander_effects_compose
- MCP mail tools: sitecommander_mail_profiles, sitecommander_mail_profile_upsert, sitecommander_bimi_status, sitecommander_bimi_prepare, sitecommander_bimi_verify, sitecommander_bimi_record
- MCP support tools: sitecommander_conversations, sitecommander_messages, sitecommander_tickets, sitecommander_ticket_messages, sitecommander_send_message
- MCP EasyApp provisioning tool: sitecommander_easyapp_ensure (creates/updates the site workspace; never returns private configuration codes or signing credentials)

Authentication uses `Authorization: Bearer <token>`. Broad MCP tokens are created once by an authenticated administrator from the MCP/API page, are shown once, and scope project/site discovery to the token creator's accessible workspaces or selected sites. A site owner can instead open a site detail page and create a site-scoped connection token for that site's server; it is shown once, rotates the previous site token, and cannot reach another site. Live-chat replies through `/api/control-plane/messages/reply` appear in the visitor's site widget and PocketPapi Support Inbox/action center. MCP/API requests are recorded for administrator troubleshooting without storing tokens or request bodies.

Connected sites send `POST /api/control-plane/events` with their site-scoped token. Use `/api/control-plane/sync-health` to verify last event/API activity, and use Audit Logs in the command center to troubleshoot working and failed calls.

PocketPapi public sites are discoverable without a token; private sites require an owner-issued configuration code shown once in Apps. PocketPapi then uses a separate site-scoped user session for leads and live chat. The legacy EasyApp route names remain for compatibility. Never place an MCP token in the PocketPapi mobile bundle.

The effects endpoints are read-only, public, and do not require command-center access. LLMs should search the catalog before writing new motion, prefer native recipes, pin third-party versions, and preserve keyboard, touch, and prefers-reduced-motion behavior.

Mail identity is site-scoped. Sender profiles accept public HTTPS photo URLs or base64 PNG/JPEG/WebP uploads up to 4 MB. BIMI preparation accepts validated SVG Tiny PS and optional VMC/CMC PEM assets, returns the DNS TXT record, and never changes DNS. Never claim BIMI is active unless the verification checks pass. BIMI is a brand-logo signal; Gmail/Microsoft 365 account photos and Outlook directory/contact photos are provider or recipient controlled.