API-first architecture

The dashboard and API are clients of the same domain model. New automation surfaces use five rules:

1. Stable identity. Workspaces, pages, buttons, forms, apps, lists, domains, and actions expose UUIDs. Legacy numeric IDs remain internal compatibility keys.
2. Explicit tenancy. Every authenticated read and write derives the workspace from the token’s accessible owner or team memberships.
3. Representation parity. HTML, Markdown, manifests, OpenAPI, MCP resources, and A2A skills are generated from the same published records.
4. Human authority. Agents may discover and request actions. Email confirmation proves the represented human approved subscriptions, bookings, and callbacks.
5. Reversible rollout. Each new vertical has its own feature flag. Additive migrations and dual-read behavior keep old embeds and pages functioning.

For backwards compatibility, Contact Button mounts its API route file at the application root. The public API v1 base is /v1 and the MCP endpoint is /mcp; do not insert Laravel’s conventional /api prefix. Older private /v1/auth and /v1/projects routes remain available to existing clients but are not part of this public contract.

​

Protocol responsibilities

Contact Button does not deploy a separate process for every button. The shared protocol gateways route by stable resource ID and enforce tenant scope centrally.