# apistock

> Prepared stock for Go APIs: a Go library and a CLI, aps, that write a production-ready API into your repository.

Every page is also served as Markdown at its address with .md, listed below. All of them in one file: https://docs.apistock.dev/llms-full.txt

## Guides

- [Introduction](https://docs.apistock.dev/index.md): apistock is a Go library and a CLI, aps, that write a production-ready API into your repository: PostgreSQL, sign-in with two-factor authentication and passkeys, organisations…
- [Quickstart](https://docs.apistock.dev/quickstart.md): Create a Full app with organisations and run it on your machine. You need Go 1.26 or later and Docker.
- [Architecture](https://docs.apistock.dev/architecture.md): Status: Accepted · Date: 2026-09-14 · Supersedes: Architecture v1 (see git history of this file)
- [Project layout](https://docs.apistock.dev/project-layout.md): This app follows the apistock layered module structure. The rules below are checked by internal/app/architecture_test.go, so go test ./... fails when they are broken.
- [Organisations](https://docs.apistock.dev/guides/organisations.md): In a multi-tenant app, data belongs to organisations. People join them as members with one role each, invite others by email, and reach an organisation's rows only while they are…
- [Database](https://docs.apistock.dev/guides/database.md): apistock.dev/modules/postgres connects apps to PostgreSQL. Decisions: ADR-0005 (PostgreSQL, goose), ADR-0028 (Docker), ADR-0032 (hand-written SQL).
- [Runtime settings](https://docs.apistock.dev/guides/runtime-settings.md): apistock.dev/modules/settings stores non-secret tunables in PostgreSQL so operators change them without a redeploy. Decision: ADR-0031. Admin endpoints: ops API reference.
- [Background jobs](https://docs.apistock.dev/guides/background-jobs.md): apistock.dev/modules/jobs runs background jobs on PostgreSQL with River. Decision: ADR-0033. Admin endpoints: ops API reference.
- [Email](https://docs.apistock.dev/guides/email.md): How a Full preset app sends email: choosing Resend or SMTP, where each setting lives, development with Mailpit, sending from code and fixing delivery problems. Implemented in…
- [Authentication](https://docs.apistock.dev/guides/authentication.md): How a Full preset app signs people up and in, keeps them signed in, and decides what they may do. Implemented in examples/full-single (internal/modules/auth) on the building…
- [Sign-in providers](https://docs.apistock.dev/guides/auth-providers.md): What a developer provides so each sign-in method works with their own accounts, where to find every value and where to paste it. Decisions: ADR-0045, ADR-0043 (authenticator…
- [Ops API](https://docs.apistock.dev/guides/ops-api.md): Admin APIs of the Full preset (internal/modules/ops), implemented in examples/full-single. The full schema is in the app's api/openapi.json and at /docs. Decisions: ADR-0026…
- [Local development](https://docs.apistock.dev/guides/local-development.md): How to work on the apistock repository: services, tests, checks and CI.

## CLI

- [CLI reference](https://docs.apistock.dev/cli.md): aps creates apistock apps, generates code in them and runs them locally. Decisions: ADR-0014 (presets and prompts), ADR-0021 (generator), ADR-0035 (interactive prompts with flag…

## API reference

- [API reference](https://docs.apistock.dev/api-reference.md): This is the API of the example multi-tenant app in examples/full-multi, rendered from its checked-in openapi.json. Every app you create with aps new serves the same reference for…
- [List audit events, newest first](https://docs.apistock.dev/api-reference/ops-audit/ops-list-audit-events.md): Who did what to which resource, and whether it worked. Filters combine; paginate with cursor.
- [Get an audit event](https://docs.apistock.dev/api-reference/ops-audit/ops-get-audit-event.md): GET /ops/audit/{id}
- [List sign-in methods and what they need](https://docs.apistock.dev/api-reference/ops-auth/ops-list-sign-in-methods.md): Whether each sign-in method is configured and, for the others, the environment variables to set (never their values). Setup steps: AUTH_PROVIDERS.md.
- [List job definitions](https://docs.apistock.dev/api-reference/ops-job-definitions/ops-list-job-definitions.md): GET /ops/jobs/definitions
- [Get a job definition](https://docs.apistock.dev/api-reference/ops-job-definitions/ops-get-job-definition.md): GET /ops/jobs/definitions/{name}
- [Change a job's configuration](https://docs.apistock.dev/api-reference/ops-job-definitions/ops-update-job-definition.md): Send only the fields to change. Applies to every instance within moments. Disabling or rescheduling requires a reason.
- [Reset a job to its code defaults](https://docs.apistock.dev/api-reference/ops-job-definitions/ops-reset-job-definition.md): DELETE /ops/jobs/definitions/{name}
- [List a job definition's changes](https://docs.apistock.dev/api-reference/ops-job-definitions/ops-job-definition-history.md): GET /ops/jobs/definitions/{name}/history
- [Run a job now](https://docs.apistock.dev/api-reference/ops-job-definitions/ops-run-job.md): POST /ops/jobs/definitions/{name}/run
- [List enabled scheduled jobs, soonest first](https://docs.apistock.dev/api-reference/ops-job-definitions/ops-list-scheduled-jobs.md): GET /ops/jobs/scheduled
- [List job runs, newest first](https://docs.apistock.dev/api-reference/ops-job-runs/ops-list-job-runs.md): GET /ops/jobs/runs
- [Get a job run](https://docs.apistock.dev/api-reference/ops-job-runs/ops-get-job-run.md): GET /ops/jobs/runs/{id}
- [Cancel a job run](https://docs.apistock.dev/api-reference/ops-job-runs/ops-cancel-job-run.md): POST /ops/jobs/runs/{id}/cancel
- [Retry a job run now](https://docs.apistock.dev/api-reference/ops-job-runs/ops-retry-job-run.md): POST /ops/jobs/runs/{id}/retry
- [Show how the app sends email](https://docs.apistock.dev/api-reference/ops-email/ops-get-mail.md): The provider, whether email goes to Mailpit or the provider, and the current sender. Change the sender with PUT /ops/settings/mail.from_email.
- [Send a test email](https://docs.apistock.dev/api-reference/ops-email/ops-send-test-email.md): Queues a test email through the same path as every other email. Check its delivery in GET /ops/jobs/runs?kind=apistock.mail.send.
- [List active job queues](https://docs.apistock.dev/api-reference/ops-job-queues/ops-list-job-queues.md): GET /ops/queues
- [Pause a queue on every instance](https://docs.apistock.dev/api-reference/ops-job-queues/ops-pause-job-queue.md): POST /ops/queues/{name}/pause
- [Resume a paused queue](https://docs.apistock.dev/api-reference/ops-job-queues/ops-resume-job-queue.md): POST /ops/queues/{name}/resume
- [List releases, newest first](https://docs.apistock.dev/api-reference/ops-releases/ops-list-releases.md): Every version and commit an instance has run, with how many instances run it now.
- [List the releases running now](https://docs.apistock.dev/api-reference/ops-releases/ops-current-releases.md): More than one during a rolling deploy. An instance counts as running until it stops or misses three heartbeats.
- [List instance starts, newest first](https://docs.apistock.dev/api-reference/ops-releases/ops-list-release-instances.md): GET /ops/releases/instances
- [List runtime settings](https://docs.apistock.dev/api-reference/ops-settings/ops-list-settings.md): GET /ops/settings
- [Get a runtime setting](https://docs.apistock.dev/api-reference/ops-settings/ops-get-setting.md): GET /ops/settings/{key}
- [Change a runtime setting](https://docs.apistock.dev/api-reference/ops-settings/ops-set-setting.md): Applies to every instance within moments. Send the version you read; a newer version returns setting_version_conflict.
- [Reset a runtime setting to its default](https://docs.apistock.dev/api-reference/ops-settings/ops-reset-setting.md): DELETE /ops/settings/{key}
- [List a runtime setting's changes](https://docs.apistock.dev/api-reference/ops-settings/ops-setting-history.md): GET /ops/settings/{key}/history
- [Apple's return to the API](https://docs.apistock.dev/api-reference/auth/auth-apple-callback.md): Apple posts the result here; the API redirects to the sign-in's return_to.
- [Apple's server-to-server notifications](https://docs.apistock.dev/api-reference/auth/auth-apple-notifications.md): Register this URL in the App ID's Sign in with Apple settings. Apple posts consent and email changes signed with its keys.
- [Sign in with an Apple ID token](https://docs.apistock.dev/api-reference/auth/auth-apple-token.md): For iOS apps. Returns a session like POST /v1/auth/login, or 202 with a second-factor challenge.
- [Google's return to the API](https://docs.apistock.dev/api-reference/auth/auth-google-callback.md): Google redirects here; the API redirects to the sign-in's return_to.
- [Sign in with a Google ID token](https://docs.apistock.dev/api-reference/auth/auth-google-token.md): For iOS and Android apps. Returns a session like POST /v1/auth/login, or 202 with a second-factor challenge.
- [List linked Google and Apple accounts](https://docs.apistock.dev/api-reference/auth/auth-list-identities.md): GET /v1/auth/identities
- [Unlink a Google or Apple account](https://docs.apistock.dev/api-reference/auth/auth-remove-identity.md): Send the password unless this session verified a second factor in the last 10 minutes. Not allowed for the account's last way to sign in.
- [Sign in](https://docs.apistock.dev/api-reference/auth/auth-login.md): Starts a session (200). Browsers get an HttpOnly __Host-session cookie; native apps pass "transport": "bearer" and get the token in the response. For an account with two-factor…
- [Finish signing in with a second factor](https://docs.apistock.dev/api-reference/auth/auth-login-mfa.md): After a 202 from POST /v1/auth/login: send the challenge token with a code from the authenticator app, a recovery code, or a passkey's response (start it with POST…
- [Start a passkey second factor](https://docs.apistock.dev/api-reference/auth/auth-login-mfa-passkey.md): After a 202 from POST /v1/auth/login listing passkey: returns options limited to the account's passkeys. Send the response to POST /v1/auth/login/mfa.
- [Sign out this device](https://docs.apistock.dev/api-reference/auth/auth-logout.md): POST /v1/auth/logout
- [Sign out every device](https://docs.apistock.dev/api-reference/auth/auth-logout-all.md): POST /v1/auth/logout-all
- [Get the signed-in user](https://docs.apistock.dev/api-reference/auth/auth-me.md): GET /v1/auth/me
- [Delete the account](https://docs.apistock.dev/api-reference/auth/auth-delete-account.md): Requires the password, and with two-factor authentication on a code, recovery code or passkey response (start one with POST /v1/auth/passkeys/verification). Signs out every device.
- [Replace the recovery codes](https://docs.apistock.dev/api-reference/auth/auth-regenerate-recovery-codes.md): Send a code from the authenticator app or a passkey's response (start one with POST /v1/auth/passkeys/verification). Returns 10 new codes, shown once; the old codes stop working.
- [Start setting up an authenticator app](https://docs.apistock.dev/api-reference/auth/auth-start-totp.md): Requires the password. Returns a secret, an otpauth:// URI and a QR code image, shown once. It turns on when a code is confirmed with POST /v1/auth/mfa/totp/confirm.
- [Turn off the authenticator app](https://docs.apistock.dev/api-reference/auth/auth-disable-totp.md): Requires the password and a code, recovery code or passkey response (start one with POST /v1/auth/passkeys/verification); signs out other devices. Not allowed while a role…
- [Turn on the authenticator app](https://docs.apistock.dev/api-reference/auth/auth-confirm-totp.md): Send a code from the authenticator app. Returns 10 recovery codes, shown once, verifies this session with a second factor and signs out other devices.
- [List passkeys](https://docs.apistock.dev/api-reference/auth/auth-list-passkeys.md): GET /v1/auth/passkeys
- [Add a passkey](https://docs.apistock.dev/api-reference/auth/auth-create-passkey.md): Send the browser's response to the registration options. Verifies this session with a second factor; the account's first second factor also returns recovery codes.
- [Sign in with a passkey](https://docs.apistock.dev/api-reference/auth/auth-passkey-login.md): Send the passkey's response. Starts a session verified with a second factor, like POST /v1/auth/login/mfa.
- [Start signing in with a passkey](https://docs.apistock.dev/api-reference/auth/auth-passkey-login-options.md): Returns the options for navigator.credentials.get(). No email or password: the chosen passkey names the account.
- [Start adding a passkey](https://docs.apistock.dev/api-reference/auth/auth-begin-passkey-registration.md): Returns the options for navigator.credentials.create(). Send the password unless this session verified a second factor in the last 10 minutes; once the account has two-factor…
- [Confirm a change with a passkey](https://docs.apistock.dev/api-reference/auth/auth-begin-passkey-verification.md): Returns options for navigator.credentials.get() limited to the user's passkeys. Send the response as passkey when deleting the account, turning off the authenticator app or…
- [Rename a passkey](https://docs.apistock.dev/api-reference/auth/auth-rename-passkey.md): PATCH /v1/auth/passkeys/{id}
- [Remove a passkey](https://docs.apistock.dev/api-reference/auth/auth-remove-passkey.md): Send the password unless this session verified a second factor in the last 10 minutes. Not allowed for the last second factor while a role requires two-factor authentication.
- [Change the password](https://docs.apistock.dev/api-reference/auth/auth-change-password.md): Signs out other devices.
- [Email a password reset code](https://docs.apistock.dev/api-reference/auth/auth-forgot-password.md): The response is the same whether or not the address has an account.
- [Set a new password with a reset code](https://docs.apistock.dev/api-reference/auth/auth-reset-password.md): Signs out every device. Two-factor authentication stays on.
- [Create an account](https://docs.apistock.dev/api-reference/auth/auth-register.md): Emails a 6-digit verification code. The response is the same whether or not the address already has an account.
- [List signed-in devices](https://docs.apistock.dev/api-reference/auth/auth-list-sessions.md): GET /v1/auth/sessions
- [Sign out one device](https://docs.apistock.dev/api-reference/auth/auth-revoke-session.md): DELETE /v1/auth/sessions/{id}
- [Verify an email address with its code](https://docs.apistock.dev/api-reference/auth/auth-verify-email.md): POST /v1/auth/verify-email
- [Send a new verification code](https://docs.apistock.dev/api-reference/auth/auth-resend-verification.md): At most once a minute per address.
- [Get a nonce for a native sign-in](https://docs.apistock.dev/api-reference/auth/auth-social-nonce.md): Put the nonce in Google's or Apple's SDK request, then send the ID token with it to POST /v1/auth/{provider}/token. It works once, for 5 minutes.
- [Sign in with Google or Apple in a browser](https://docs.apistock.dev/api-reference/auth/auth-start-social.md): Open it in the browser (a link or redirect, not fetch): it sets a short-lived cookie and redirects to the provider. The provider returns to the callback, which redirects to…
- [Echo a message](https://docs.apistock.dev/api-reference/example/echo.md): Returns the trimmed message. Blank messages are rejected with the message_required error code.
- [Check the API is reachable](https://docs.apistock.dev/api-reference/example/ping.md): GET /v1/ping
- [Accept an invitation](https://docs.apistock.dev/api-reference/organisations/invitations-accept.md): POST /v1/invitations/accept
- [List your organisations](https://docs.apistock.dev/api-reference/organisations/orgs-list.md): Your personal workspace first, then by name.
- [Create an organisation](https://docs.apistock.dev/api-reference/organisations/orgs-create.md): You become its owner.
- [Get an organisation](https://docs.apistock.dev/api-reference/organisations/orgs-get.md): GET /v1/orgs/{orgId}
- [Rename an organisation](https://docs.apistock.dev/api-reference/organisations/orgs-rename.md): PATCH /v1/orgs/{orgId}
- [Delete an organisation](https://docs.apistock.dev/api-reference/organisations/orgs-delete.md): Members lose access at once. An owner can restore it until the retention period (orgs.deleted_org_retention) ends; then it is purged with its data. Personal workspaces can't be…
- [List open invitations](https://docs.apistock.dev/api-reference/organisations/orgs-invitations-list.md): Invitations that weren't accepted or revoked, expired ones included, newest first.
- [Invite someone](https://docs.apistock.dev/api-reference/organisations/orgs-invitations-create.md): Emails a link to the frontend page in orgs.invitation_url. Accepting needs an account whose verified email is the invited address.
- [Revoke an invitation](https://docs.apistock.dev/api-reference/organisations/orgs-invitations-revoke.md): DELETE /v1/orgs/{orgId}/invitations/{invitationId}
- [Resend an invitation](https://docs.apistock.dev/api-reference/organisations/orgs-invitations-resend.md): Sends a new link with a new expiry; the old link stops working.
- [Leave an organisation](https://docs.apistock.dev/api-reference/organisations/orgs-leave.md): The last owner can't leave, and nobody leaves their personal workspace.
- [List members](https://docs.apistock.dev/api-reference/organisations/orgs-members-list.md): Owners first, then in the order they joined.
- [Change a member's role](https://docs.apistock.dev/api-reference/organisations/orgs-members-change-role.md): Nobody can give or change a role above their own, only owners change owners, and the last owner can't be demoted.
- [Remove a member](https://docs.apistock.dev/api-reference/organisations/orgs-members-remove.md): DELETE /v1/orgs/{orgId}/members/{userId}
- [Restore a deleted organisation](https://docs.apistock.dev/api-reference/organisations/orgs-restore.md): POST /v1/orgs/{orgId}/restore
- [List the organisation's projects](https://docs.apistock.dev/api-reference/projects/projects-list.md): Newest first unless sort says otherwise; sort by one of created_at, updated_at or name. Paginate with cursor.
- [Create a project](https://docs.apistock.dev/api-reference/projects/projects-create.md): POST /v1/orgs/{orgId}/projects
- [Get a project](https://docs.apistock.dev/api-reference/projects/projects-get.md): GET /v1/orgs/{orgId}/projects/{id}
- [Update a project](https://docs.apistock.dev/api-reference/projects/projects-update.md): Send the fields to change and the version you read.
- [Delete a project](https://docs.apistock.dev/api-reference/projects/projects-delete.md): DELETE /v1/orgs/{orgId}/projects/{id}
- [Build information](https://docs.apistock.dev/api-reference/system/get-version.md): GET /version

## Decisions

- [Decisions](https://docs.apistock.dev/decisions.md): Each ADR records one decision: context, options, decision, reasons, trade-offs and consequences.
- [Framework boundaries](https://docs.apistock.dev/decisions/0001-framework-boundaries.md): Status: Accepted (2026-09-14), amended by ADR-0014 and ADR-0019
- [Module architecture](https://docs.apistock.dev/decisions/0002-module-architecture.md): Status: Superseded by ADR-0019 and ADR-0021 (2026-09-14)
- [Code generation](https://docs.apistock.dev/decisions/0003-code-generation.md): Status: Accepted (2026-09-14), amended by ADR-0021 and the merge spike (spikes/merge/README.md)
- [Dependency injection](https://docs.apistock.dev/decisions/0004-dependency-injection.md): Status: Superseded by ADR-0017 and ADR-0020 (2026-09-14)
- [Database strategy](https://docs.apistock.dev/decisions/0005-database-strategy.md): Status: Accepted (2026-09-14) · Amended by: ADR-0032 (hand-written SQL replaces sqlc), ADR-0033 (River's tables use River's migrator)
- [Authentication](https://docs.apistock.dev/decisions/0006-authentication.md): Status: Superseded by ADR-0024 (2026-09-14)
- [Observability](https://docs.apistock.dev/decisions/0007-observability.md): Status: Accepted (2026-09-14), amended by ADR-0019 (SDK in its own module) and ADR-0028 (Grafana opt-in)
- [Configuration](https://docs.apistock.dev/decisions/0008-configuration.md): Status: Superseded by ADR-0020 (2026-09-14)
- [Repository strategy](https://docs.apistock.dev/decisions/0009-repository-strategy.md): Status: Accepted (2026-09-14), amended by ADR-0019 (core module at repository root)
- [Dashboard architecture](https://docs.apistock.dev/decisions/0010-dashboard-architecture.md): Status: Accepted (2026-09-14), amended by ADR-0026 (ops APIs, API only) and ADR-0028 (dev console in v1.1)
- [GitHub integration](https://docs.apistock.dev/decisions/0011-github-integration.md): Status: Accepted (2026-09-14)
- [Versioning and upgrades](https://docs.apistock.dev/decisions/0012-versioning-and-upgrades.md): Status: Superseded by ADR-0015 and ADR-0016 (2026-09-14)
- [Multi-tenancy](https://docs.apistock.dev/decisions/0013-multi-tenancy.md): Status: Superseded by ADR-0023 (2026-09-14)
- [Product shape, presets and creation prompts](https://docs.apistock.dev/decisions/0014-product-shape-and-presets.md): Status: Accepted (2026-09-14) · Amends: ADR-0001 · Amended by: ADR-0035 (interactive prompts with flag parity), ADR-0041 (Full preset generated from examples/full-single)…
- [Public API surface and stability tiers](https://docs.apistock.dev/decisions/0015-public-api-and-stability-tiers.md): Status: Accepted (2026-09-14) · Supersedes (with ADR-0016): ADR-0012
- [Scaffold compatibility and upgrade path](https://docs.apistock.dev/decisions/0016-scaffold-compatibility-and-upgrades.md): Status: Accepted (2026-09-14) · Supersedes (with ADR-0015): ADR-0012 · Amended by: ADR-0050 (the merge base is rebuilt from the recorded release and inputs and checked against…
- [Application lifecycle](https://docs.apistock.dev/decisions/0017-application-lifecycle.md): Status: Accepted (2026-09-14) · Supersedes (with ADR-0020): ADR-0004
- [Error contract and problem+json](https://docs.apistock.dev/decisions/0018-error-contract.md): Status: Accepted (2026-09-14)
- [Module dependency rules and core budget](https://docs.apistock.dev/decisions/0019-module-dependency-rules.md): Status: Accepted (2026-09-14) · Supersedes (with ADR-0021): ADR-0002 · Amends: ADR-0001, ADR-0007, ADR-0009 · Amended by: ADR-0033
- [Constructors and configuration](https://docs.apistock.dev/decisions/0020-constructors-and-configuration.md): Status: Accepted (2026-09-14) · Supersedes: ADR-0008 · Supersedes (with ADR-0017): ADR-0004 · Amended by: ADR-0031
- [Generator operation model](https://docs.apistock.dev/decisions/0021-generator-operation-model.md): Status: Accepted (2026-09-14) · Amends: ADR-0003 · Supersedes (with ADR-0019): ADR-0002 · Amended by: ADR-0041, ADR-0050 (the operation vocabulary and replayed operation log are…
- [Generated application layout](https://docs.apistock.dev/decisions/0022-generated-application-layout.md): Status: Accepted (2026-09-14) · Amended by: ADR-0032
- [Tenancy](https://docs.apistock.dev/decisions/0023-tenancy.md): Status: Accepted (2026-09-14) · Supersedes: ADR-0013 · Amended by: ADR-0033, ADR-0048 (org roles in org_members, 404 for non-members, invitation and personal workspace rules, aps…
- [Authentication methods](https://docs.apistock.dev/decisions/0024-authentication-methods.md): Status: Accepted (2026-09-14) · Supersedes: ADR-0006 · Amended by: ADR-0038 (flows, tables and SQL live in the generated app's internal/modules/auth; modules/auth provides…
- [Email providers](https://docs.apistock.dev/decisions/0025-email-providers.md): Status: Accepted (2026-09-14) · Amended by: ADR-0033 (two-step mail worker and jobs.AsyncSender(client) wiring), ADR-0037 (aps add mail, Resend over its HTTP API instead of the…
- [Operations APIs](https://docs.apistock.dev/decisions/0026-operations-apis.md): Status: Accepted (2026-09-14) · Amends: ADR-0010 · Amended by: ADR-0031, ADR-0033, ADR-0034 (interim ops token until authentication), ADR-0036 (audit list and get moved to v0.2)…
- [API contract and documentation](https://docs.apistock.dev/decisions/0027-api-contract-and-docs.md): Status: Accepted (2026-09-14), amended by ADR-0049 · decided by spikes/openapi
- [Local development environment](https://docs.apistock.dev/decisions/0028-local-development-environment.md): Status: Accepted (2026-09-14) · Amends: ADR-0007, ADR-0010 · Amended by: ADR-0042 (seed password printed once, never stored)
- [Threat model: framework, CLI and ecosystem](https://docs.apistock.dev/decisions/0029-threat-model.md): Status: Accepted (2026-09-14) · Amended by: ADR-0036 (audit metadata controls)
- [Context and correlation propagation](https://docs.apistock.dev/decisions/0030-context-and-correlation.md): Status: Accepted (2026-09-14)
- [Runtime settings](https://docs.apistock.dev/decisions/0031-runtime-settings.md): Status: Accepted (2026-09-14) · Amends: ADR-0020, ADR-0026
- [Hand-written SQL in repositories](https://docs.apistock.dev/decisions/0032-repository-sql.md): Status: Accepted (2026-09-14) · Amends: ADR-0005, ADR-0022
- [Background jobs](https://docs.apistock.dev/decisions/0033-background-jobs.md): Status: Accepted (2026-09-14) · Amends: ADR-0005, ADR-0019, ADR-0023, ADR-0025, ADR-0026
- [Interim ops token](https://docs.apistock.dev/decisions/0034-interim-ops-token.md): Status: Superseded by ADR-0038 (2026-09-15): OPS_TOKEN is removed; /ops/* uses signed-in sessions and platform roles · Amends: ADR-0026
- [Interactive CLI with flag parity](https://docs.apistock.dev/decisions/0035-interactive-cli.md): Status: Accepted (2026-09-14) · Amends: ADR-0014, ADR-0021 · Amended by: ADR-0037 (aps add mail; secrets are asked with hidden input and never flags)
- [Audit storage](https://docs.apistock.dev/decisions/0036-audit-storage.md): Status: Accepted (2026-09-14) · Amends: ADR-0026, ADR-0029
- [Email setup and delivery](https://docs.apistock.dev/decisions/0037-email-setup-and-delivery.md): Status: Accepted (2026-09-14) · Amends: ADR-0025, ADR-0035
- [Authentication in v0.2](https://docs.apistock.dev/decisions/0038-authentication-v0-2.md): Status: Accepted (2026-09-15) · Amends: ADR-0024, ADR-0026, ADR-0029 · Supersedes: ADR-0034 · Amended by: ADR-0048 (multi-tenant apps create a personal workspace with each account…
- [Resource module template](https://docs.apistock.dev/decisions/0039-resource-module-template.md): Status: Accepted (2026-09-15) · Amends: ADR-0022, ADR-0023 · Amended by: ADR-0048 (org-scoped resources: --scope org, the default in multi-tenant apps)
- [Release tracking](https://docs.apistock.dev/decisions/0040-release-tracking.md): Status: Accepted (2026-09-15) · Amends: ADR-0026
- [Full preset generation](https://docs.apistock.dev/decisions/0041-full-preset-generation.md): Status: Accepted (2026-09-15) · Amends: ADR-0014, ADR-0021, ADR-0028 · Amended by: ADR-0050 (apistock.lock v2 records the release, template inputs and file hashes)
- [Development seed data](https://docs.apistock.dev/decisions/0042-development-seed-data.md): Status: Accepted (2026-09-15) · Amends: ADR-0028 · Amended by: ADR-0043 (seed also enrolls the administrator in 2FA)
- [Two-factor authentication](https://docs.apistock.dev/decisions/0043-two-factor-authentication.md): Status: Accepted (2026-09-15) · Amends: ADR-0024, ADR-0038, ADR-0042 · Amended by: ADR-0044 (a passkey also turns two-factor authentication on), ADR-0046 (Google and Apple…
- [Passkeys](https://docs.apistock.dev/decisions/0044-passkeys.md): Status: Accepted (2026-09-15) · Amends: ADR-0024, ADR-0043
- [Sign-in provider setup](https://docs.apistock.dev/decisions/0045-sign-in-provider-setup.md): Status: Accepted (2026-09-15) · Amends: ADR-0024, ADR-0028, ADR-0044 · Amended by: ADR-0046 (APP_PUBLIC_URL, the Google and Apple status lines)
- [Google and Apple sign-in](https://docs.apistock.dev/decisions/0046-google-and-apple-sign-in.md): Status: Accepted (2026-09-15) · Amends: ADR-0024, ADR-0043, ADR-0045
- [Client templates](https://docs.apistock.dev/decisions/0047-client-templates.md): Status: Proposed (2026-09-15) · Would amend: ADR-0010, ADR-0014, ADR-0021, ADR-0029
- [Organisations (v0.4)](https://docs.apistock.dev/decisions/0048-organisations-v0-4.md): Status: Accepted (2026-09-15) · Amends: ADR-0023, ADR-0038 · Amended by: ADR-0050 (aps add orgs merges base-full into base-full-multi and converts data with new migrations)
- [Public website, framework docs and API reference](https://docs.apistock.dev/decisions/0049-public-docs-and-website.md): Status: Accepted (2026-09-15) · Amends: roadmap v1.0 (the docs site moves out of v1.0), ADR-0027 (/docs no longer embeds Scalar)
- [Upgrading apps and adding features to them (v0.5)](https://docs.apistock.dev/decisions/0050-upgrades-and-adding-features.md): Status: Accepted (2026-09-15) · Amends: ADR-0014, ADR-0016, ADR-0021, ADR-0041, ADR-0048

## Roadmap

- [Roadmap](https://docs.apistock.dev/roadmap.md): Status: Accepted (2026-09-14) · Replaces: scope-v1.md