Documentation

Everything you need to deploy and use Sovereign Mind.

Getting started

Onboarding

Administrators invite users via POST /auth/invite with an email address and org ID. The recipient follows the email link, chooses Azure AD or Google, and is provisioned into the system. No passwords are ever stored.

Authentication

OAuth & Session Management

All auth is delegated to Azure AD or Google Workspace. Refresh tokens are AES-256-GCM encrypted at rest. Browser sessions are managed via express-session; the iOS app uses a short-lived exchange-code flow that produces a long-lived Bearer token stored in Keychain.

POST /auth/invite — admin: create invitation
GET /auth/accept-invite?token=… — user: begin OAuth flow
POST /auth/refresh — silent token refresh
POST /auth/logout — destroy session

Wiki

Knowledge Collections & Share Links

Knowledge collections are scoped to an org. Admins can generate a time-limited share token to let external stakeholders view a specific collection without creating an account.

GET /wiki/:collection — view collection (auth or share token)
POST /api/wiki/collections/:collection/share — admin: create share token

iOS app

Mobile Integration

Build the iOS app with xcodegen generate && xcodebuild. Update Config.swift → backendBaseURL to point at your deployed backend before building for a physical device.