Skip to content
hlix docs

Client portal

Generated from contract version 1.0.0 — the same document /v1/api/openapi.json serves.

Prerequisites

Section titled “Prerequisites”
  • An API key in x-api-key, or a browser session cookie
  • X-Organization-Id naming the workspace to act in, unless the session already has an active one
  • The base URL for your deployment, https://server.hlix.ai by default

Operations

Section titled “Operations”
Method Path Operation
GET /v1/api/client-portal/activity List client-visible activity
GET /v1/api/client-portal/overview Get the portal landing view

List client-visible activity

Section titled “List client-visible activity”

GET /v1/api/client-portal/activity · operation ID listClientPortalActivity

Parameters

Name In Required Type Description
type query no string One ClientActivityType. Filtered SERVER-side on purpose: the overview caps its list at twenty items of all kinds, so filtering that list client-side hides real work behind an omission that looks like an absence. An UNRECOGNISED type answers [] rather than everything — silently widening a filter nobody asked to widen is how a narrow request answers with more than it should.
limit query no string Page size, clamped to 200. Defaults to 100.
X-Organization-Id header no string The workspace (organization) to act in. Omitted, the session’s active organization is used.
X-Client-Portal header no string Agency organization id for one aggregate client dashboard; server derives only this caller’s workspace relationship and owned account seats. Legacy account ids remain narrowly compatible. Real verified user session required for agency context; administration denied.

Responses

Status Body Description
200 ClientActivityItem[] Client-visible activity, newest first. There is no actor field: a customer is told what changed, never who inside the agency changed it.
400 ApiError The request named no active organization.
401 ApiError No valid session or API key.
403 ApiError Authenticated, but not a member of the named organization — or a client collaborator without the required access on this project.
404 ApiError The resource does not exist, or the caller is a task-scoped credential and this endpoint is outside its allowlist.

Get the portal landing view

Section titled “Get the portal landing view”

GET /v1/api/client-portal/overview · operation ID getClientPortalOverview

Parameters

Name In Required Type Description
X-Organization-Id header no string The workspace (organization) to act in. Omitted, the session’s active organization is used.
X-Client-Portal header no string Agency organization id for one aggregate client dashboard; server derives only this caller’s workspace relationship and owned account seats. Legacy account ids remain narrowly compatible. Real verified user session required for agency context; administration denied.

Responses

Status Body Description
200 ClientPortalOverview The viewer’s projects and their twenty most recent client-visible events, of every kind.
400 ApiError The request named no active organization.
401 ApiError No valid session or API key.
403 ApiError Authenticated, but not a member of the named organization — or a client collaborator without the required access on this project.
404 ApiError The resource does not exist, or the caller is a task-scoped credential and this endpoint is outside its allowlist.

If a request fails

Section titled “If a request fails”

These apply to every operation on this page.

  • 400 — the body failed schema validation, or the request named no active organization. A ValidationError body carries the failing fields; an ApiError body carries only error.
  • 401 — no valid session or API key.
  • 403 — authenticated, but not a member of the named organization, or a client collaborator without the required access.
  • 404 — no such resource in this workspace. Absent and not-visible are deliberately the same answer; do not infer cross-tenant existence from it.
  • 409 — the expected revision or state is stale, or another operation currently owns the transition.
  • 500 — the operation failed server-side. Retry only where an idempotency key makes that safe.

Next steps

Section titled “Next steps”
API referenceEvery resource in the published contract, and what is deliberately not in it.
API & OpenAPIDownload the contract, generate a client, and read the compatibility policy.
TypeScript SDKAuth, retries, typed errors, uploads and streaming, already built.
CLI referenceThe same operations from a terminal, with a stable JSON envelope.