API route index
Base URL
Local: http://localhost:4175. Production default used by the web app: https://api.ngamia.com. Route paths below are relative to that origin. The API is a NestJS 11 application running on the Express 5 adapter.
Implemented routes
| Method | Path | Auth | Request | Success |
|---|---|---|---|---|
GET | /api/health | Public | None | JSON status |
POST | /api/auth/camel | OAuth code | JSON code and verifier | {ok:true} plus cookies |
GET | /api/auth/session | Optional cookie | None | Profile, or auth state JSON |
POST | /api/auth/logout | Optional cookies | None | {ok:true}; clears cookies |
GET | /api/music/models | Ngamia session | None | Upstream model catalog |
POST | /api/music/generate | Ngamia session | Generation JSON | Audio stream |
| Any method (proxied) | /api/ngamia/v1/{path} | Except specific public reads | Upstream-specific | Upstream body/status |
Nest’s global CORS middleware handles preflight for GET, POST, PATCH, DELETE, and OPTIONS. Auth and Music controller routes reject requests without an allowed Origin. The Express proxy rejects a present but disallowed Origin, but allows requests without an Origin header. The proxy middleware can forward other methods for non-browser clients, although those methods are not declared in the CORS policy.
Endpoint reference
- Authentication routes: code exchange, session inspection, logout.
- Music routes: model catalog and audio generation.
- Ngamia API proxy: supported path and method behavior, headers, and known consumers.
Shared client rules
- Use
credentials: 'include'for browser calls that need the session. - Send requests from an exact configured allowed origin.
- Send JSON with
Content-Type: application/jsonon JSON writes. - Send
Idempotency-Keyon retryable generation or payment initiation when the upstream supports idempotency. - Treat audio endpoints as binary and check
response.okbefore reading the body. - JSON and URL-encoded bodies are limited to 2 MB by the Express parsers; generation applies tighter field-specific limits.
- The API’s local errors use
{error:{message}}; proxied upstream endpoints retain their own schemas.
The catch-all proxy’s upstream methods, field validation, and response schemas are controlled by the separate Ngamia API. This site documents only proxy mechanics and examples found in the Music web app; it does not claim an exhaustive upstream contract.