JantaHR developer resources

The API (NestJS, Prisma, Postgres), the web app (Next.js) and the mobile app (Expo) are in one repository under AGPL-3.0: github.com/devag7/jantahr. Contribution notes are in CONTRIBUTING.md, and the legal basis for each statutory rule is in docs/legal-2026.md.

The web and mobile apps use a JSON REST API, served on this site under /api. /api/health reports whether it is up. Requests and responses are JSON, and every error has the same shape. Calls are limited to 300 a minute from one address.

The API is described in OpenAPI 3.0 at /openapi.json. It is generated from the routes and their validation rules, so it always matches the running API: each operation has an operationId, typed parameters, a request schema and the role or plan feature it needs. Handlers do not declare what they return, so success responses are described as JSON without a fixed shape. Running the API locally also gives a browsable Swagger page at /docs.

Every API call carries a Supabase Auth access token as a bearer token: Authorization: Bearer <access token>. A person signs in with email and password, a magic link or Google, with two-factor where they have enrolled it, and the API maps that sign-in to their JantaHR account, company and role. There are no long-lived API keys, so an integration acts as a signed-in user and can do only what that user's role allows.

A Model Context Protocol server is available at /mcp over the Streamable HTTP transport, with a discovery document at /.well-known/mcp. It needs no sign-in and is read-only: its tools return this site's pages as Markdown, the plans and prices, and contact details. It does not read or change company data.

/llms.txt describes when to use JantaHR and lists every public page. Each page is also served as Markdown when a request sends Accept: text/markdown, and /sitemap.xml lists the same pages for crawlers.

One command starts the product with a complete Supabase stack on Docker. Start with the self-hosting page, then the full guide in deploy/self-hosted/README.md.

Please report vulnerabilities privately, as described in SECURITY.md, not in a public issue.