Reference

API reference

15 routes. Secrets live only in server-side environment variables; the browser holds none. Manual refreshes are limited to one per 10 minutes. Each line says what the route does in plain words: click it for who can call it, what you send, what comes back and the safety limits.

Integrations

Names of configured integrations only: secret values never leave the server.

DatabaseConfigured
Supabase Postgres holds investors, signals and runs.
GeminiConfigured
Gemini Flash reads and judges the evidence.
AI backupConfigured
A second route to the same Gemini Flash model, used only if the first fails.
SearchConfigured
Tavily finds public pages about each investor.
Mail draftsConfigured
Fills your name and pitch into each draft. It never sends mail.
CalendlyConfigured
The meeting link added to every draft.
TelegramConfigured
The daily report to your phone.
CronConfigured
Starts the Monday and Thursday refresh.
AdminOpen demo
Open demo mode: no passcode needed.

Public: Anyone can call it. It reveals only facts the dashboard already shows, never a key or a note.
Passcode required: For actions a person takes in the app (refresh now, edit relationship, add a startup). The browser sends the admin passcode you type; it is never stored. On this open demo site the passcode is switched off, so these work without one.
Secret required: For machines, not people: the scheduled refresh, its internal hand-off and re-scoring. The caller must send a long server-side secret, which no page or browser ever holds, so these cannot be triggered from the website.

Pipeline and refresh

Health, the scheduled and manual refresh, and re-scoring.

GETThe automatic twice-weekly refresh

/api/cron/refresh

Secret required

Every Monday and Thursday the scheduler calls this. It picks the investors worth checking, looks for their news from the last 30 days, scores them and saves the four signal columns. Your notes are never touched.

Who can call it

Authorization: Bearer $CRON_SECRET (Vercel Cron sends it automatically). Fails closed if the secret is not set.

What you get back

202A run started or resumed: { run_id, state }.
200state is already_running (overlap guard) or nothing_due (everyone was checked recently; zero credits spent).
401Missing or wrong secret.
500Required environment variables are missing (names listed, never values).

Safety limits

At most one active run (a unique index in the database). Function time limit 300 s; longer runs hand off to /api/refresh/continue.

Technical summary

The twice-weekly scheduled refresh (Vercel Cron: Monday and Thursday 04:00 UTC = 09:30 IST). Plans which investors are worth searching, creates a durable run, and returns at once; the work continues in the background in chunks.

Try it

curl -H "Authorization: Bearer $CRON_SECRET" https://vc-pipeline-intelligence.vercel.app/api/cron/refresh

GETThe daily Telegram report

/api/cron/digest

Secret required

Every morning the scheduler calls this. It sends you one short message: who to email first, how many follow-ups are due, and who not to chase. It reads the saved scores and changes nothing.

Who can call it

Authorization: Bearer $CRON_SECRET (Vercel Cron sends it automatically). Fails closed if the secret is not set.

What you get back

200{ sent: true }, or { sent: false, reason: telegram_not_configured } until TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID are set.
401Missing or wrong secret.
502Telegram refused the message.

Safety limits

One message a day. Carries firm names, scores and public headlines only: never contact history, notes or email addresses.

Technical summary

Daily report (Vercel Cron: 05:30 UTC = 11:00 IST). Builds a plain-text summary from the stored pipeline and sends it through the Telegram Bot API. Read-only: no database writes, no search credits.

Try it

curl -H "Authorization: Bearer $CRON_SECRET" https://vc-pipeline-intelligence.vercel.app/api/cron/digest

POSTFinish a long refresh

/api/refresh/continue

Secret required

A refresh can take longer than one server run, so it hands the rest to a new run. The app calls this itself; people never do.

Who can call it

Authorization: Bearer $CRON_SECRET.

What you send

{ "run_id": "<uuid>", "chain": 1..50 }

What you get back

202{ accepted: true }; the work runs after the response.
400Body failed validation.
401Missing or wrong secret.

Safety limits

Chain depth capped at 20. If a hand-off is lost, the run's heartbeat goes stale and the next cron or manual trigger resumes it.

Technical summary

Internal hand-off: continues a run that did not fit in one invocation. Called by the app itself, not by people.

POSTRe-score without searching

/api/rescore

Secret required

Recalculates every score from evidence that is already saved. It uses no search credits and no AI, and it makes older evidence fade day by day.

Who can call it

Authorization: Bearer $CRON_SECRET.

What you get back

200{ investors, changed, action_changes, angles, skipped }
409A refresh is in progress.
401Missing or wrong secret.

Safety limits

Writes only the four signal-derived columns, as the restricted refresh role. Never-checked investors are not scored.

Technical summary

Re-scores every checked investor from the evidence already stored. No search credits, no model calls. Applies the passage of time and any scoring-rule change.

Try it

curl -X POST -H "Authorization: Bearer $CRON_SECRET" https://…/api/rescore

Integrations

Names of configured integrations only: secret values never leave the server.

DatabaseConfigured

Supabase Postgres holds investors, signals and runs.

GeminiConfigured

Gemini Flash reads and judges the evidence.

AI backupConfigured

A second route to the same Gemini Flash model, used only if the first fails.

SearchConfigured

Tavily finds public pages about each investor.

Mail draftsConfigured

Fills your name and pitch into each draft. It never sends mail.

CalendlyConfigured

The meeting link added to every draft.

TelegramConfigured

The daily report to your phone.

CronConfigured

Starts the Monday and Thursday refresh.

AdminOpen demo

Open demo mode: no passcode needed.