NajmHoda API — v1 Messaging & Authorization Boundaries

EarthCoop's current /api/v1 first-party/native-client contract includes a versioned NajmHoda messaging endpoint:

/api/v1/najm-hoda/message

This endpoint is real current product behavior. It does not turn NajmHoda into an unrestricted public automation API and it does not give the client authority to mutate EarthCoop state merely by describing an action in a message.

Current v1 messaging contract

The versioned endpoint accepts an authenticated native/client request under the current v1 middleware and domain rules. Use the current controller/tests for exact payload fields, response shape, rate limits and validation.

The broader web application also has unversioned NajmHoda routes for conversation history and specialized first-party flows. Those paths should not be silently treated as part of /api/v1 unless they are actually registered there.

Server authorization

Client context is informational. It cannot grant authority.

Any action-capable NajmHoda path must pass trusted server-side checks such as:

authenticated identity;
ownership of the target context;
current group/role or domain authorization;
applicable policy and validation;
the underlying domain service's own execution rules.

A NajmHoda response, suggestion, draft, or conversational confirmation is not evidence that a governance, economic, administrative or support action has been authorized or completed. The responsible domain must perform and record the operation.

Conversation and specialized web capabilities

The current web NajmHoda subsystem contains additional owner-scoped conversation and context-aware capabilities. These can include listing/showing conversations, archive/delete state, feedback, support escalation, and selected context-specific assistance.

They are current application capabilities where implemented, but they are not all automatically exported through the current v1 native route set.

Support escalation

NajmHoda can participate in conditional support escalation. The policy/service decides when the criteria are met and the support subsystem remains responsible for the formal ticket record. A message sent to the v1 assistant endpoint does not guarantee ticket creation.

Draft-capable helpers

Selected helpers can prepare or save drafts under their own trusted server context. Draft assistance does not inherit authority to submit, register, dispatch, publish or execute a protected domain action.

Stability and public integration boundary

/api/v1/najm-hoda/message is a current versioned first-party/native-client endpoint. EarthCoop has not thereby declared every internal NajmHoda controller method or orchestration capability to be a stable third-party public API.

versioned v1 message route = current native/client contract
client context ≠ authority
assistant suggestion ≠ executed domain action
server authorization + domain execution + audit = valid mutation