medianfi-com

medianfi-com Threads API

The Threads API from medianfi-com — 3 operation(s) for threads.

GitHub OpenAPI

Operations 7

GET /companies/{companyId}/threads List threads (paginated, optional status filter) #
POST /companies/{companyId}/threads Create a new thread #
GET /companies/{companyId}/threads/{threadId} Get a thread by ID #
PATCH /companies/{companyId}/threads/{threadId} Update a thread (subject, status) #
DELETE /companies/{companyId}/threads/{threadId} Delete a thread #
GET /companies/{companyId}/threads/{threadId}/messages List messages in a thread (chronological ASC) #
POST /companies/{companyId}/threads/{threadId}/messages Create a message in a thread (with optional attachments) #

Specifications

⚙
OpenAPI
https://artifacts.apis.io/medianfi-com/openapi/medianfi-com-threads-api-openapi.yml

Schemas & Data

📊
JSONSchema
https://artifacts.apis.io/medianfi-com/json-schema/medianfi-com-practice-packet-v1-schema.json
📊
JSONSchema
https://artifacts.apis.io/medianfi-com/json-schema/medianfi-com-therapist-metrics-envelope-response-schema.json
📊
JSONSchema
https://artifacts.apis.io/medianfi-com/json-schema/medianfi-com-sub-ledger-liabilities-view-schema.json
📊
JSONSchema
https://artifacts.apis.io/medianfi-com/json-schema/medianfi-com-quick-books-chart-push-preview-schema.json
📊
JSONSchema
https://artifacts.apis.io/medianfi-com/json-schema/medianfi-com-books-overview-schema.json
📊
JSONSchema
https://artifacts.apis.io/medianfi-com/json-schema/medianfi-com-agent-client-facts-schema.json

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/medianfi-com:medianfi-com-threads-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

medianfi-com-threads-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Median Threads API
  version: 0.1.0
  description: Production-grade Node.js + Express API starter template
  license:
    name: Proprietary
servers:
- url: /api/v1
security: []
tags:
- name: Threads
paths:
  /companies/{companyId}/threads:
    parameters:
    - $ref: '#/components/parameters/companyId'
    get:
      operationId: listThreads
      summary: List threads (paginated, optional status filter)
      tags:
      - Threads
      security:
      - bearerAuth: []
      parameters:
      - name: status
        in: query
        schema:
          type: string
          enum:
          - open
          - resolved
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/cursor'
      responses:
        '200':
          description: Paginated list of threads
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreadsListResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
    post:
      operationId: createThread
      summary: Create a new thread
      tags:
      - Threads
      security:
      - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateThreadInput'
      responses:
        '201':
          description: Thread created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreadResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '422':
          description: Validation error
  /companies/{companyId}/threads/{threadId}:
    parameters:
    - $ref: '#/components/parameters/companyId'
    - $ref: '#/components/parameters/threadId'
    get:
      operationId: getThread
      summary: Get a thread by ID
      tags:
      - Threads
      security:
      - bearerAuth: []
      responses:
        '200':
          description: Thread found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreadResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Thread not found
    patch:
      operationId: updateThread
      summary: Update a thread (subject, status)
      tags:
      - Threads
      security:
      - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateThreadInput'
      responses:
        '200':
          description: Thread updated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreadResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Thread not found
        '422':
          description: Validation error
    delete:
      operationId: deleteThread
      summary: Delete a thread
      tags:
      - Threads
      security:
      - bearerAuth: []
      responses:
        '204':
          description: Thread deleted
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Thread not found
  /companies/{companyId}/threads/{threadId}/messages:
    parameters:
    - $ref: '#/components/parameters/companyId'
    - $ref: '#/components/parameters/threadId'
    get:
      operationId: listThreadMessages
      summary: List messages in a thread (chronological ASC)
      description: 'Each attachment is resolved for the caller on every read. A `document` or `file` attachment that resolves inside the thread''s company, under the caller''s own authority, with a servable stored file, is `available` and carries a `downloadUrl` minted for this caller; otherwise it is `available: false` with no link, whatever the reason.'
      tags:
      - Threads
      security:
      - bearerAuth: []
      parameters:
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/cursor'
      responses:
        '200':
          description: Paginated list of messages with embedded attachments
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreadMessagesListResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Thread not found
    post:
      operationId: createThreadMessage
      summary: Create a message in a thread (with optional attachments)
      description: Every attached document or transaction is admitted against the thread's company and the caller's authority before anything is written; the message and its attachments are stored together or not at all.
      tags:
      - Threads
      security:
      - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateThreadMessageInput'
      responses:
        '201':
          description: Message created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreadMessageResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: The thread was not found, or an attached document or transaction does not resolve for the caller in this company. A reference that belongs to another company, one that does not exist and one the caller has no authority over get the same answer. Nothing is written.
        '422':
          description: 'Validation error, or `THREAD_ATTACHMENT_NOT_ACCEPTED`: an attached document the caller may see has no stored file or its scan verdict is not clean. Nothing is written.'
components:
  schemas:
    ThreadAttachment:
      type: object
      properties:
        id:
          type: string
          format: uuid
        messageId:
          type: string
          format: uuid
        type:
          type: string
          enum:
          - file
          - link
          - document
          - transaction
          - schedule_proposal
        label:
          type:
          - string
          - 'null'
        url:
          type:
          - string
          - 'null'
          description: 'The stored link of a `link` or `transaction` attachment: an http(s) URL or a root-relative path. Always null for a `document` or `file` attachment, whose link is `downloadUrl`.'
        refId:
          type:
          - string
          - 'null'
          format: uuid
          description: The referenced document or transaction. It is resolved only inside the thread's own company.
        available:
          type: boolean
          description: 'False when a `document` or `file` attachment does not resolve for this caller: the reference is missing, belongs elsewhere, is outside the caller''s authority, or its stored file is not servable. The reason is not disclosed. Always true for other kinds.'
        downloadUrl:
          type:
          - string
          - 'null'
          description: A download link minted for this caller on this read, valid until `downloadUrlExpiresAt`. Root-relative. Null unless the attachment is an available `document` or `file`. The download endpoint checks the caller's access again when the link is used.
        downloadUrlExpiresAt:
          type:
          - string
          - 'null'
          format: date-time
        createdAt:
          type: string
          format: date-time
      required:
      - id
      - messageId
      - type
      - label
      - url
      - refId
      - available
      - downloadUrl
      - downloadUrlExpiresAt
      - createdAt
    PaginationMeta:
      type: object
      properties:
        nextCursor:
          type:
          - string
          - 'null'
        hasMore:
          type: boolean
    ProblemDetail:
      type: object
      properties:
        type:
          type: string
        title:
          type: string
          description: 'For application errors, a stable UPPER_SNAKE machine code (for example `NOT_FOUND`, `FORECAST_NOT_FOUND`, `VALIDATION_ERROR`). Clients branch on this, never on `detail` wording. A few transport level responses use a short human title instead.

            '
        status:
          type: integer
        detail:
          type: string
          description: 'Human-readable explanation; correlate a failure with `traceId`. A NOT_FOUND-family 404 names the resource type (for example "Company not found"), not its id. Some legacy messages still include an id (tracked in #2666).

            '
        instance:
          type: string
        traceId:
          type: string
        retryAfter:
          type: integer
          minimum: 0
          description: Whole seconds until retry is allowed for a 429 response
        errors:
          type: array
          items:
            type: object
            properties:
              field:
                type: string
              message:
                type: string
        extensions:
          type: object
          additionalProperties: true
    ThreadMessagesListResponse:
      type: object
      properties:
        success:
          type: boolean
        data:
          type: array
          items:
            $ref: '#/components/schemas/ThreadMessage'
        meta:
          $ref: '#/components/schemas/PaginationMeta'
    ThreadResponse:
      type: object
      properties:
        success:
          type: boolean
        data:
          $ref: '#/components/schemas/Thread'
    ThreadAttachmentInput:
      type: object
      description: 'A user attachment. `document`, or `file` with a `refId`: `refId` is required and names an uploaded document of the thread''s company; a `url` may be sent (or null) and is discarded; the attachment is stored as `document`. `file` without `refId` is refused. `link`: `url` is required. `transaction`: `refId` is required. Internal kinds such as `schedule_proposal` are never accepted.'
      properties:
        type:
          type: string
          enum:
          - file
          - link
          - document
          - transaction
          default: file
        label:
          type: string
          maxLength: 255
        url:
          type:
          - string
          - 'null'
          description: An http(s) URL or a root-relative path. Required for `link`; ignored for `document` and `file`.
        refId:
          type: string
          format: uuid
          description: Required for `document`, `file` and `transaction`.
    CreateThreadInput:
      type: object
      required:
      - subject
      properties:
        subject:
          type: string
          minLength: 1
          maxLength: 1000
        agentType:
          type: string
          enum:
          - human
          - ai
          default: human
        agentName:
          type: string
          maxLength: 255
    ThreadMessageResponse:
      type: object
      properties:
        success:
          type: boolean
        data:
          $ref: '#/components/schemas/ThreadMessage'
    ThreadsListResponse:
      type: object
      properties:
        success:
          type: boolean
        data:
          type: array
          items:
            $ref: '#/components/schemas/Thread'
        meta:
          $ref: '#/components/schemas/PaginationMeta'
    UpdateThreadInput:
      type: object
      properties:
        subject:
          type: string
          minLength: 1
          maxLength: 1000
        status:
          type: string
          enum:
          - open
          - resolved
    Thread:
      type: object
      properties:
        id:
          type: string
          format: uuid
        companyId:
          type: string
          format: uuid
        subject:
          type: string
        status:
          type: string
          enum:
          - open
          - resolved
        agentType:
          type: string
          enum:
          - human
          - ai
        agentName:
          type:
          - string
          - 'null'
        initiatedByUserId:
          type:
          - string
          - 'null'
          format: uuid
        createdBy:
          type:
          - string
          - 'null'
          format: uuid
        resolvedBy:
          type:
          - string
          - 'null'
          format: uuid
        resolvedAt:
          type:
          - string
          - 'null'
          format: date-time
        lastActivityAt:
          type: string
          format: date-time
        lastMessageAt:
          type:
          - string
          - 'null'
          format: date-time
        updatedAt:
          type: string
          format: date-time
        createdAt:
          type: string
          format: date-time
    ThreadMessage:
      type: object
      properties:
        id:
          type: string
          format: uuid
        threadId:
          type: string
          format: uuid
        companyId:
          type: string
          format: uuid
        authorId:
          type:
          - string
          - 'null'
          format: uuid
        body:
          type: string
        attachments:
          type: array
          items:
            $ref: '#/components/schemas/ThreadAttachment'
        createdAt:
          type: string
          format: date-time
        updatedAt:
          type: string
          format: date-time
    CreateThreadMessageInput:
      type: object
      description: Either a non-empty body or at least one attachment is required; an attachment-only message may omit the body or send it empty.
      properties:
        body:
          type: string
          default: ''
        attachments:
          type: array
          maxItems: 20
          items:
            $ref: '#/components/schemas/ThreadAttachmentInput'
  parameters:
    threadId:
      name: threadId
      in: path
      required: true
      schema:
        type: string
        format: uuid
    cursor:
      name: cursor
      in: query
      schema:
        type: string
    limit:
      name: limit
      in: query
      schema:
        type: integer
        minimum: 1
        maximum: 100
        default: 50
    companyId:
      name: companyId
      in: path
      required: true
      schema:
        type: string
        format: uuid
  responses:
    Forbidden:
      description: Insufficient permissions or not a company member
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ProblemDetail'
    Unauthorized:
      description: Authentication required
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ProblemDetail'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
    serviceApiKey:
      type: apiKey
      in: header
      name: X-API-Key
      description: 'Persistent credential for the configured cloud-bookkeeping service principal. The key must carry accountant:* and is accepted only on accountant operations that explicitly list this scheme. Ordinary API keys, and service keys presented to bearer-only operations, are denied.

        '
    refreshSessionCookie:
      type: apiKey
      in: cookie
      name: __Secure-median_refresh
      description: 'Exact production HttpOnly refresh-session cookie. Local non-secure development uses median_refresh.

        '
    passkeyEnrollmentGrantCookie:
      type: apiKey
      in: cookie
      name: __Secure-median_passkey_enrollment
      description: 'Exact production HttpOnly passkey-enrollment grant cookie. Local non-secure development uses median_passkey_enrollment.

        '
    webAuthnCeremonyCookie:
      type: apiKey
      in: cookie
      name: __Secure-median_webauthn
      description: 'Exact production HttpOnly WebAuthn ceremony cookie. Local non-secure development uses median_webauthn.

        '
x-median-quarantined-authorities:
  decision: ADR-0001-model-a
  runtimeStatus: unmounted
  description: 'Migrations 267-272 modeled legal entities as separate company tenants. These paths are not runtime API authority while their preserved accounting math is re-keyed to legal entities inside one company workspace.

    '
  paths:
  - /companies/{companyId}/consolidation-groups
  - /companies/{companyId}/consolidation-groups/{groupId}/versions/{groupVersionId}/report-rollups
  - /companies/{companyId}/consolidation-groups/{groupId}/versions/{groupVersionId}/report-rollups/{rollupId}
  - /companies/{companyId}/consolidation-groups/{groupId}/versions/{groupVersionId}/translation-adjustments
  - /companies/{companyId}/consolidation-groups/{groupId}/versions/{groupVersionId}/translation-adjustments/{adjustmentId}
x-median-demo-parity-customer-surface:
  runtimeStatus: mounted-lifecycle-only
  description: 'v2 customer-app capabilities available to JWT-authenticated members of any active or test company — the v2 app is the product, not a rollout cohort, so no allowlist applies to the markerless path. Production customer calls omit X-Median-App-Surface. Test-company calls may carry X-Median-App-Surface: qa to select the QA bundle; that marker branch alone still requires membership in CUSTOMER_APP_DEMO_PARITY_COMPANY_IDS. An API key, unknown marker, malformed company id, inactive company, missing gate dependency, or failed company lookup receives the standard hidden-resource 404 contract. The held surfaces riding these prefixes (AR/AP, Forecast, Insights) carry their own additional allowlist gate — see x-median-forecast-hold and x-median-ar-ap-hold.

    '
  headerContract: '#/components/parameters/demoParityCustomerAppSurface'
  routePrefixes:
  - /companies/{companyId}/ar
  - /companies/{companyId}/ap
  - /companies/{companyId}/customers
  - /companies/{companyId}/vendors
  - /companies/{companyId}/contracts
  - /companies/{companyId}/receivables
  - /companies/{companyId}/entities
  - /companies/{companyId}/currencies
  - /companies/{companyId}/reporting-scopes
  - /companies/{companyId}/reporting-scopes/{reportingScopeId}/versions/{versionId}/rollups
  - /companies/{companyId}/reporting-scopes/{reportingScopeId}/versions/{versionId}/translation-adjustments
  - /companies/{companyId}/presentation-report-snapshots
  - /companies/{companyId}/reporting-trial-balances
  - /companies/{companyId}/reporting-scopes/{reportingScopeId}/versions/{versionId}/trial-balances
  - /companies/{companyId}/reporting-scopes/{reportingScopeId}/versions/{versionId}/intercompany
  - /companies/{companyId}/weekly-email
  - /companies/{companyId}/forecast
  - /companies/{companyId}/books
  - /companies/{companyId}/sub-ledgers
x-median-forecast-hold:
  runtimeStatus: mounted-only-with-server-gate
  description: 'Forecast is held. Beyond the lifecycle-only customer surface above, every operation under the prefix below also requires the company to appear in the held-surface allowlist CUSTOMER_APP_DEMO_PARITY_COMPANY_IDS — the one operator-set list that opens AR/AP, Forecast and Insights (the legacy CUSTOMER_APP_FORECAST_COMPANY_IDS variable is no longer consulted). It is empty by default, so the v2 rollout alone never exposes Forecast. A company off the list receives the same hidden-resource 404 contract as one for which the surface does not exist. The auth-context featureFlags key `forecast` mirrors this verdict for the customer app shell.

    '
  featureFlag: forecast
  routePrefixes:
  - /companies/{companyId}/forecast
x-median-ar-ap-hold:
  runtimeStatus: mounted-only-with-server-gate
  description: 'Receivables/Payables are held behind TWO required authorities. Beyond the lifecycle-only customer surface above, every operation under the prefixes below requires the company to appear in the held-surface allowlist CUSTOMER_APP_DEMO_PARITY_COMPANY_IDS (requireDemoParityAllowlistedCompany) AND to satisfy the company_subledger_flags conversion chain (requireArApItemsEnabled — the same authority the public /pay page, aging and the accountant portal consult); failing either answers the opaque 404. The auth-context featureFlags key `arApItems` mirrors exactly that conjunction, resolved server-side, so the customer shell hides the Receivables/Payables nav and pages instead of offering menu entries these routes 404. Default is FALSE for every company while the list is empty or the conversion has not run.

    '
  featureFlag: arApItems
  routePrefixes:
  - /companies/{companyId}/ar
  - /companies/{companyId}/ap
  - /companies/{companyId}/customers
  - /companies/{companyId}/vendors
  - /companies/{companyId}/contracts
  - /companies/{companyId}/receivables
x-median-demo-parity-qa-only:
  runtimeStatus: mounted-only-with-server-gate
  description: 'Strict test-company-only routes. Every interactive call requires X-Median-App-Surface: qa in addition to JWT authentication, the server allowlist, and persisted client_status=test. A copied header, API key, active company, missing gate dependency, or failed company lookup receives the standard hidden-resource 404 contract.

    '
  headerContract: '#/components/parameters/qaAppSurface'
  routePrefixes:
  - /companies/{companyId}/gl-accounts/{id}/monetary-classification
  - /companies/{companyId}/fx-account-roles
  - /companies/{companyId}/gl-periods/{periodId}/fx-revaluation
  - /accountant/companies/{customerId}/gl-accounts/{id}/monetary-classification
  - /accountant/companies/{customerId}/fx-account-roles
  - /accountant/companies/{customerId}/gl-periods/{periodId}/fx-revaluation
  - /accountant/companies/{customerId}/ar/{id}
  - /accountant/companies/{customerId}/ap/{id}
x-median-onboarding-v3-surface:
  runtimeStatus: promoted
  promotionFlag: ONBOARDING_V3_QA_ONLY=false
  description: 'Promoted. The deployment this contract describes runs ONBOARDING_V3_QA_ONLY=false, so none of the onboarding-v3 auth, pricing, or setup paths below requires X-Median-App-Surface: qa. An unmarked request is served and reaches ordinary authentication, so an unauthenticated call now answers 401 rather than the hidden-resource 404. Mounting is still conditional: with ONBOARDING_V3_ENABLED false every path below returns the hidden-resource 404 before body parsing or authentication. The header stays defined and is still honoured, because a deployment left at ONBOARDING_V3_QA_ONLY=true keeps requiring it on every path below and 404s unmarked traffic; setting that flag back to true is the rollback. On either setting the header is a pre-company bundle marker, never tenant authorization.

    '
  headerContract: '#/components/parameters/onboardingV3QaSurface'
  routePaths:
  - /auth/otp/start
  - /auth/otp/verify
  - /auth/passkeys/register/options
  - /auth/passkeys/register/verify
  - /auth/passkeys/assert/options
  - /auth/passkeys/assert/verify
  - /onboarding/v3/quote
  - /onboarding/v3/offer/resolve
  - /onboarding/v3/flow
  - /onboarding/v3/setup-intent
  - /onboarding/v3/subscribe
  - /onboarding/v3/test-account-activation
  - /onboarding/v3/checkout-session
  - /onboarding/v3/checkout-session/complete
  - /onboarding/v3/setup-state
  - /onboarding/v3/delegate-invites
  - /onboarding/v3/delegate-invites/{inviteId}
  - /onboarding/v3/delegate/resolve
  - /onboarding/v3/delegate
  - /onboarding/v3/task-context
  - /onboarding/v3/delegate/task-context
  - /onboarding/v3/banks/plaid/link-token
  - /onboarding/v3/banks/plaid/exchange
  - /onboarding/v3/banks/commit
  - /onboarding/v3/documents/google-workspace/auth-url
  - /onboarding/v3/documents/google-workspace/callback
  - /onboarding/v3/books/quickbooks/auth-url
  - /onboarding/v3/books/quickbooks/callback
  - /onboarding/v3/books/xero/auth-url
  - /onboarding/v3/books/xero/callback
  - /onboarding/v3/welcome-call
  - /onboarding/v3/welcome-call/embed
  - /onboarding/v3/books-progress
  - /onboarding/v3/books/open
  - /companies/{companyId}/onboarding/v3/questions
  - /companies/{companyId}/onboarding/v3/questions/{questionId}/answer
  - /companies/{companyId}/onboarding/v3/review-items