API Reference

Yugati exposes HTTP endpoints for agent interaction, voice transcription, and payments. All endpoints require an authenticated session cookie.

better-auth.session_token— required on all requests. Unauthenticated requests return401

POST/api/agent/chat

Runs the AI agent and streams the response as Server-Sent Events (SSE). Three-layer gating: character limit → rate limit → monthly quota.

Request body

{
  "messages": [
    { "role": "user", "content": "Summarise my last 5 emails" }
  ],
  "conversationId": "uuid",     // optional — omit to start a new session
  "agentMode": "guided" | "auto" // default: "guided"
}

SSE event stream

type	Payload
delta	{ text: string }
done	{ conversationId: string }
blocked	{ reason: string, conversationId: string }
error	{ message: string, conversationId: string }

Error codes

400	Message exceeds plan character limit
401	Not authenticated
403	Account suspended
429	Rate limit or monthly quota exceeded

POST/api/voice/transcribe

Transcribes an audio clip using OpenAI Whisper. Counts against the monthly voice quota.

Request

multipart/form-data with one field:

audio   File   WebM audio blob, max ~25 MB

Response

{ "text": "Summarise my last 5 emails" }

Error codes

401	Not authenticated
429	Monthly voice quota exceeded

POST/api/payments/create-order

Creates a Razorpay payment order for a plan upgrade.

Request body

{ "plan": "standard" | "premium" }

Response

{
  "orderId":  "order_xxx",
  "amount":   19900,        // paise — ₹199.00
  "currency": "INR",
  "keyId":    "rzp_live_xxx",
  "planName": "Standard"
}

POST/api/payments/verify

Verifies Razorpay HMAC signature and upgrades the user plan on success. Redirects to /dashboard/billing?upgraded=1.

Request body

{
  "razorpayOrderId":   "order_xxx",
  "razorpayPaymentId": "pay_xxx",
  "razorpaySignature": "hmac_sha256_hex"
}

Error codes

400	Invalid or missing HMAC signature
401	Not authenticated

GET/api/payments/invoice/[orderId]

Streams a PDF invoice for a paid order. Returns application/pdf with inline disposition. Only the order owner can access it.

Path parameter

orderId   string   Order ID from the orders table

Error codes

401	Not authenticated
404	Order not found or not paid

POST/api/payments/webhook

Server-to-server Razorpay webhook for payment.captured events. Acts as a backup to the client-side verify flow. Verifies the X-Razorpay-Signature header.

Headers

X-Razorpay-Signature: hmac_sha256_hex

Error codes

400	Invalid signature or unrecognised event

GET/api/corsair/connect

Initiates the Corsair OAuth flow for a given integration (Gmail or Google Calendar). Designed to be opened in a popup window — the parent page polls popup.closed and refetches connection status once the popup closes.

Query parameters

integration   string   "gmail" | "googlecalendar"

Response

Redirects to the Google OAuth consent screen.

GET/api/corsair/callback

Handles the OAuth callback from Google after the user approves the consent screen. Stores the encrypted credentials and redirects.

Response

On success → redirects to /dashboard/integrations?connected=1
On error → redirects to /dashboard/integrations?error=connect_failed

POST/api/auth/clear-session

Clears the session cookie and signs the user out. Called on manual sign-out.

Response

200 OK — cookie cleared, user is signed out

ALL/api/auth/[...all]

Catch-all handler for better-auth. Handles Google OAuth sign-in, session management, token refresh, and sign-out. Not called directly — managed by the authClient SDK on the frontend.

Key routes handled internally

GET  /api/auth/sign-in/google
GET  /api/auth/callback/google
POST /api/auth/sign-out
GET  /api/auth/get-session

tRPCPOST /api/trpc/[router].[procedure]

All email, calendar, plan, and user data is served via tRPC. Procedures are end-to-end type-safe and consumed by the frontend using the useTRPC hook.

Router	Procedures
gmail.*	listInbox, getMessage, sendMessage, trashMessage, createDraft, updateDraft, sendDraft, listLabels
calendar.*	listEvents, createEvent, updateEvent, deleteEvent
plans.*	getMyPlan, getOrders, cancelSubscription
user.*	getPreferences, savePreferences
stats.*	getConnectionStatus, getEmailVolume

All data encrypted in transit and at rest

Docs Home