Browser clients should use the same-origin API path exposed by the current SPA host:
const API_BASE = '/api/v1'
If you need an absolute URL outside the browser, use https://app.equa.cc/api/v1 unless a direct API hostname has been freshly re-verified. Every request must include credentials: 'include' so the session cookie is sent automatically.
Magic link endpoints (/user/magic-link and /user/magic-link/verify) are implemented in the auth module but not yet registered as REST endpoints. This example shows the planned usage.
// Step 1: Request magic link (planned)await equaApi('/user/magic-link', { method: 'POST', body: JSON.stringify({ email: 'user@example.com' }),})// Step 2: Verify token from the email link (planned)const user = await equaApi('/user/magic-link/verify', { method: 'POST', body: JSON.stringify({ token: tokenFromEmail }),})
const formData = new FormData()formData.append('file', fileInput.files[0])const response = await fetch(`${API_BASE}/organization/${orgId}/document`, { method: 'POST', credentials: 'include', body: formData, // Do not set Content-Type header; the browser sets it with the boundary})