One product, multiple interfaces

The application, external clients, and operations tools all meet Orbit through authenticated interfaces. The design keeps the data model and capability rules consistent across those surfaces.

REST API

The /v1 API groups routes around categories, habits, entries, mood, journals, integrations, wheel, assessments, chat, voice, UI coordination, telemetry, counselor access, and viewer access. Admin routes add ticket and telemetry inspection functionality.

Shipped REST endpoints are the primary application contract.

Remote MCP

MCP is served from the same application as the REST API. Compatible clients authenticate against the remote service and can invoke generic record tools as well as named shortcuts such as check_habit, get_balance, and get_latest_mood.

The tool catalog also includes specialized tool groups for:

• Journal drafting and finalization.
• Ticket administration.
• Telemetry lookup.
• UI target discovery and actions.

OAuth and resource discovery

OAuth authorization metadata, OpenID configuration, and protected-resource metadata allow clients to discover how to request access. Login, consent, and error routes complete the human authorization flow.

Interface design rules

• Authentication precedes access to personal data.
• Roles constrain which routes and app views are available.
• Cross-surface actions retain request and session context.
• Tools should act on defined entities instead of creating untracked side channels.