# 87 — API surface + token auth

## Goal

Documented HTTP API for existing modules (calendar, lists, notes, garden, bangs) with token auth suitable for non-browser clients, coexisting with OIDC session auth.

## Why

API-early batch order: foundation lands after bugs so journal and notes can extend it; LLM agent (88) maps tools onto it.

## Depends on

- ADR `0006-api-llm-agent.md` research half (Gitea #14) — auth model and API shape decided before implementation

## Scope

- Architecture ADR 0006: token auth vs OIDC session coexistence; API shape; additive versioning (no freeze that blocks journal).
- Token auth for non-browser clients.
- Endpoints for existing entities: events, lists/items, notes, garden, bangs (dashboards as needed).
- API docs (OpenAPI or equivalent living doc).
- Vitest for auth + route handlers; optional Playwright smoke only if useful.

## Out of scope

- LLM agent chat UI and tool-calling (88).
- Journal endpoints (86 adds them).

## Acceptance criteria

- [ ] ADR 0006 documents auth coexistence and API shape.
- [ ] Token-authenticated client can read/write covered entities.
- [ ] Session (OIDC) auth still works for the web app.
- [ ] Docs list endpoints and auth.
- [ ] Unit/integration tests for auth and handlers.

## Notes

- Gitea: epic [#13](https://gitea.ginnoir.com/ginnoir/famapp/issues/13); research [#14](https://gitea.ginnoir.com/ginnoir/famapp/issues/14); implementation [#15](https://gitea.ginnoir.com/ginnoir/famapp/issues/15)
- Batch step 6 (after bugs 80–84)