Nexriva API reference

Public endpoints for integrations

Three machine- and operator-facing routes are exposed by the Nexriva platform. Every request shape, response shape, and status code on this page matches the route handlers in src/app/api exactly — if you find drift, treat it as a doc bug and report it.

Quick reference

3 endpoints

Method	Path	Auth
POST	/api/deploy/precheck	Shared secret (machine caller)
POST	/api/chat	Monitor session cookie
POST	/api/reports/weekly-digest	Monitor session cookie

POST

/api/deploy/precheck

Deploy precheck

Run the posture pass against active remediation playbooks before a deploy proceeds. Returns pass / fail / timeout so CI can branch on the result.

WhenCall from your CI job right before promoting an environment. If status is fail, exit 1; if timeout, warn or fail per your own policy.

Authentication

Shared secret (machine caller). Header x-deploy-precheck-token compared with env DEPLOY_PRECHECK_TOKEN via timingSafeEqual. This is NOT better-auth — humans cannot call this endpoint.

cURL

bash

curl -X POST https://nexriva.app/api/deploy/precheck \
  -H "content-type: application/json" \
  -H "x-deploy-precheck-token: $DEPLOY_PRECHECK_TOKEN" \
  -d '{
    "deployId": "dpl_2026_08_13_abc123",
    "repo": "nexriva/payments",
    "branch": "main",
    "environment": "production",
    "changeSummary": "Add idempotency-cache fallback to webhook handler.",
    "timestamp": "2026-08-13T10:00:00.000Z"
  }'

Body (JSON)

json

{
  "deployId": "dpl_2026_08_13_abc123",
  "repo": "nexriva/payments",
  "branch": "main",
  "environment": "production",
  "changeSummary": "Add idempotency-cache fallback to webhook handler.",
  "timestamp": "2026-08-13T10:00:00.000Z"
}

POST

/api/chat

SRE copilot chat

Single-turn chat with the dashboard SRE assistant. Send one user message, get one assistant message back — non-streaming, validated through the same zod contract on the response side.

WhenUse from the dashboard chat widget. Each turn costs one upstream LLM call. The route never streams; if you need partial tokens, keep it on the client side.

Authentication

Monitor session cookie. Authenticated via the same better-auth monitor session that gates /dashboard. Unauthenticated callers see 401 before any LLM call is made.

cURL

bash

curl -X POST https://nexriva.app/api/chat \
  -H "content-type: application/json" \
  -b "nexriva_session=<your cookie>" \
  -d '{
    "message": "What is the P95 latency on /incidents tonight?"
  }'

Body (JSON)

json

{
  "message": "What is the P95 latency on /incidents tonight?"
}

POST

/api/reports/weekly-digest

Weekly digest (operator action)

Aggregate anomalies that resolved (auto-RECOVERED or operator-bulk-acknowledged) in the trailing 7 days, render them through the weekly digest email template, and send it to the operator inbox.

WhenThis is a SIDE-EFFECT endpoint — it triggers an outbound email and returns the count, it does NOT return the incident payload. To read incidents, query the dashboard.

Authentication

Monitor session cookie. Authenticated via the same better-auth monitor session as the rest of the operator surface. Operators only — admin role is not enforced beyond session presence.

cURL

bash

curl -X POST https://nexriva.app/api/reports/weekly-digest \
  -b "nexriva_session=<your cookie>"

Body (JSON)

json

{}