Website API

Session and request protection

Fetch a session before mutating state. Preserve its cookie and send the csrf value in X-CSRF-Token. Same-origin checks, request-size limits and route-specific throttles also apply. Authentication and organization permissions are checked on every protected request.

GET /api/session
POST /api/inquiries
POST /api/demos/dieweaver
POST /api/demos/modelnative

Run from Python

This example runs against the local website server. It reads the included sample file and performs an actual calculation.

import json, urllib.request, http.cookiejar
jar = http.cookiejar.CookieJar()
client = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(jar))
base = "http://127.0.0.1:8000"
session = json.load(client.open(base + "/api/session"))
payload = json.load(open("content/dieweaver-input.json"))
req = urllib.request.Request(base + "/api/demos/dieweaver",
    data=json.dumps(payload).encode(),
    headers={"Content-Type":"application/json", "X-CSRF-Token":session["csrf"]})
print(json.load(client.open(req)))

Response discipline

200 means a calculation or operation completed. 401 requires sign-in; 403 rejects authority or CSRF; 409 rejects a state conflict; 413 rejects oversized input; 422 rejects invalid input; 429 throttles repeated attempts; 503 indicates no demo result is available. A successful calculation may still report an infeasible scenario.

Customer and staff routes

Customer routes include organization switching, invitations, support tickets, quote review and licensed download links. Staff actions require a separately provisioned, verified staff account. The OpenAPI JSON documents route shapes; production browser documentation is self-hosted.

GET /openapi.json
GET /portal
POST /api/portal/tickets
POST /api/portal/downloads
GET /download/{one_time_token}