# Client portal

Generated from contract version `1.0.0` — the same document [`/v1/api/openapi.json`](/api/openapi/) serves.

## Prerequisites

- An API key in `x-api-key`, or a browser session cookie
- `X-Organization-Id` naming the workspace to act in, unless the session already has an active one
- The base URL for your deployment, `https://server.hlix.ai` by default

## Operations

| Method | Path | Operation |
| --- | --- | --- |
| `GET` | `/v1/api/client-portal/activity` | [List client-visible activity](#list-client-visible-activity) |
| `GET` | `/v1/api/client-portal/overview` | [Get the portal landing view](#get-the-portal-landing-view) |

## List client-visible activity

`GET /v1/api/client-portal/activity` · operation ID `listClientPortalActivity`

**Parameters**

| Name | In | Required | Type | Description |
| --- | --- | --- | --- | --- |
| `type` | query | no | string | One `ClientActivityType`. Filtered SERVER-side on purpose: the overview caps its list at twenty items of all kinds, so filtering that list client-side hides real work behind an omission that looks like an absence. An UNRECOGNISED type answers `[]` rather than everything — silently widening a filter nobody asked to widen is how a narrow request answers with more than it should. |
| `limit` | query | no | string | Page size, clamped to 200. Defaults to 100. |
| `X-Organization-Id` | header | no | string | The workspace (organization) to act in. Omitted, the session's active organization is used. |
| `X-Client-Portal` | header | no | string | Agency organization id for one aggregate client dashboard; server derives only this caller's workspace relationship and owned account seats. Legacy account ids remain narrowly compatible. Real verified user session required for agency context; administration denied. |

**Responses**

| Status | Body | Description |
| --- | --- | --- |
| `200` | ClientActivityItem[] | Client-visible activity, newest first. There is no actor field: a customer is told what changed, never who inside the agency changed it. |
| `400` | ApiError | The request named no active organization. |
| `401` | ApiError | No valid session or API key. |
| `403` | ApiError | Authenticated, but not a member of the named organization — or a client collaborator without the required access on this project. |
| `404` | ApiError | The resource does not exist, or the caller is a task-scoped credential and this endpoint is outside its allowlist. |

## Get the portal landing view

`GET /v1/api/client-portal/overview` · operation ID `getClientPortalOverview`

**Parameters**

| Name | In | Required | Type | Description |
| --- | --- | --- | --- | --- |
| `X-Organization-Id` | header | no | string | The workspace (organization) to act in. Omitted, the session's active organization is used. |
| `X-Client-Portal` | header | no | string | Agency organization id for one aggregate client dashboard; server derives only this caller's workspace relationship and owned account seats. Legacy account ids remain narrowly compatible. Real verified user session required for agency context; administration denied. |

**Responses**

| Status | Body | Description |
| --- | --- | --- |
| `200` | ClientPortalOverview | The viewer's projects and their twenty most recent client-visible events, of every kind. |
| `400` | ApiError | The request named no active organization. |
| `401` | ApiError | No valid session or API key. |
| `403` | ApiError | Authenticated, but not a member of the named organization — or a client collaborator without the required access on this project. |
| `404` | ApiError | The resource does not exist, or the caller is a task-scoped credential and this endpoint is outside its allowlist. |

## If a request fails

These apply to every operation on this page.

- `400` — the body failed schema validation, or the request named no active organization. A `ValidationError` body carries the failing fields; an `ApiError` body carries only `error`.
- `401` — no valid session or API key.
- `403` — authenticated, but not a member of the named organization, or a client collaborator without the required access.
- `404` — no such resource **in this workspace**. Absent and not-visible are deliberately the same answer; do not infer cross-tenant existence from it.
- `409` — the expected revision or state is stale, or another operation currently owns the transition.
- `500` — the operation failed server-side. Retry only where an idempotency key makes that safe.

## Next steps

[API reference](/api/reference/)
  [API & OpenAPI](/api/openapi/)
  [TypeScript SDK](/sdk/typescript/)
  [CLI reference](/reference/cli/)