# Mobile companion API

Used by the Remora PWA. All calls take `Authorization: Bearer <api key>`.

| Call | What it does |
| --- | --- |
| `POST /api/v1/mobile/login` `{email, password, device}` | Returns `{token, keyId, user}`. The token is a new API key named `Mobile: <device>`; delete it under API keys to sign that phone out. No cookie is set. |
| `GET /api/v1/push/key` | The VAPID public key (base64url) for `pushManager.subscribe`. Created on first use, stored sealed in the database. |
| `POST /api/v1/push/subscriptions` `{endpoint, keys:{p256dh, auth}, topics, device}` | Registers or updates a device (matched by endpoint). The caller's personal topic is always added. |
| `GET /api/v1/push/subscriptions` | The caller's devices. |
| `DELETE /api/v1/push/subscriptions/{id}` | Removes one. |
| `POST /api/v1/push/test` | Sends a test push to the caller's devices and reports each result. |
| `POST /api/v1/alerts/{id}/escalate` | Runs the alert's next escalation step now. |
| `GET /api/v1/hammerhead/edges` | Read-only edges and online state from a linked Hammerhead (`{configured, edges}`). |

Push payload (JSON, encrypted with aes128gcm): `id, topic, title, message, priority, tags, time, status`, plus `alert`
(the alert id) on on-call alerts, so the app can offer Acknowledge, Snooze and Escalate. Messages are cut to 1200 characters.
A push service answering 404 or 410 removes the subscription.

`SANDBAR_APP_DIR` serves the app at `/app/`. `SANDBAR_APP_ORIGIN` lets an app hosted elsewhere call `/api/v1/*` (CORS).