Core purpose
An open connection does not mean giving every third party all data. Each application must know what it may read and write, whom it represents, which quota applies, and how it can recover from failure.
REZICS treats server routes and typed schema definitions as the single hand-authored contract source, then generates OpenAPI, typed clients, and documentation from them. Typed server-side access policies enforce authentication and authorization; a hidden interface control is never the security boundary.
What is available now
- Access works, content, Realms, progress, and other exposed capabilities through the public API.
- Generate consistent OpenAPI documentation from server routes and typed schema definitions.
- Authenticate requests with a session or a scoped API token.
- Apply operation-specific quotas, error responses, and server-side access policies.
- Use generated typed clients and the
@rezics/apipackage. - Keep concurrency tokens, request limits, and recoverable semantics for complex workflows such as content structures.
The direction for OAuth and MCP
OAuth will let people authorize third-party applications without sharing a password or long-lived personal token. MCP can let AI tools help add books, update metadata, or run workflows within a scope that people can understand and revoke.
The goal is controlled participation in building work data even for people who do not use APIs directly. Third-party OAuth applications, consent screens, callbacks, security review, and an official MCP server are not all implemented yet, so these capabilities are marked as in development.
Large-content workflows
For a book content structure, a single request may compile at most 10,000 logical changes; the limit is not the book’s total node count. A large web-novel import must batch work, retain checkpoints, handle stale revisions and uncertain outcomes, and never place hundreds of thousands of nodes in one unbounded transaction.
Relationships and boundaries
OpenAPI describes a transport contract; it does not automatically describe every multi-step task. The API does not bypass product permissions, and MCP gains no extra authority merely because an AI calls it. Data and viewer permission must be revalidated at every network, storage, and cache boundary.