# QodexAI API

**Canonical:** https://apis.io/apis/qodex/qodex-api/  
**Provider:** QodexAI — https://apis.io/providers/qodex/  
**Base URL:** https://agents.qodex.ai  
**Documentation:** https://qodex.ai/docs/api-testing-endpoint-catalog

QodexAI API is one of 2 APIs that [QodexAI](https://apis.io/providers/qodex/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. This API exposes 6 JSON Schema definitions. The published artifact set on APIs.io includes an OpenAPI specification and 6 JSON Schemas.

QodexAI API as documented publicly: 27 operations. Contract generated from the documentation by API Evangelist (2026-10-21); not the provider's own document.

## Operations (27)

| Method | Path | Summary |
|---|---|---|
| POST | `/api/cart/promo` | POST /api/cart/promo |
| GET | `/api/health` | GET /api/health |
| GET | `/api/orders` | Inverted semantics |
| POST | `/api/orders` | POST /api/orders failed – Anonymous user cannot create an order |
| GET | `/api/orders/{id}` | Sensitive endpoints |
| POST | `/api/p/{slug}` | POST /api/p/{slug} |
| GET | `/api/profile/{profileId}` | Critical **Missing auth on profile endpoint** - _security_ - Verified |
| POST | `/api/projects/acme-staging/webhooks/trigger` | POST /api/projects/acme-staging/webhooks/trigger |
| GET | `/api/projects/my-project-slug/test-runs/run_01H8X3J4N5` | GET /api/projects/my-project-slug/test-runs/run_01H8X3J4N5 |
| POST | `/api/projects/my-project-slug/webhooks/trigger` | POST /api/projects/my-project-slug/webhooks/trigger |
| POST | `/api/refunds` | POST /api/refunds |
| PATCH | `/api/users/me` | Inverted semantics |
| POST | `/api/webhooks/schedules/{secret}` | Per-schedule webhook |
| POST | `/auth/login` | Reject login with invalid password |
| POST | `/checkout` | POST /checkout |
| GET | `/invoices/{orgb}` | Cross‑org invoice read is refused – GET /invoices/{orgB} then expect 403 as admin member anonymous |
| GET | `/orders/{id}` | scn_c3d4 GET /orders/:id IDOR returns 403 [FAIL] |
| GET | `/orgs/{orgb}/billing` | AI Code Review Backed by Real Test Runs |
| GET | `/orgs/{orgb}/invoices` | GET /orgs/{orgB}/invoices expected 403. |
| GET | `/path%20with%20spaces` | GET /path%20with%20spaces |
| GET | `/pets/{petid}` | Worked Example: Fix a Broken Path Parameter |
| POST | `/users` | API test scenarios |
| POST | `/v1/auth/refresh` | POST /v1/auth/refresh → 200 rotated session token |
| GET | `/v1/cart` | GET /v1/cart → 200 … 2 items preserved |
| POST | `/v1/orders` | POST /v1/orders |
| POST | `/v1/payments` | POST /v1/payments → 402 { "error": "card_expired", "decline_code": "expired_card" } |
| POST | `/webhooks/trigger` | Event-driven |

## Machine-readable artifacts (7)

- **OpenAPI** — https://artifacts.apis.io/qodex/openapi/_ae-authored/qodex-openapi-generated.yml
- **JSONSchema** — https://artifacts.apis.io/qodex/json-schema/qodex-post-v1-payments-request-schema.json
- **JSONSchema** — https://artifacts.apis.io/qodex/json-schema/qodex-post-checkout-response-schema.json
- **JSONSchema** — https://artifacts.apis.io/qodex/json-schema/qodex-post-api-orders-request-schema.json
- **JSONSchema** — https://artifacts.apis.io/qodex/json-schema/qodex-post-api-orders-response-schema.json
- **JSONSchema** — https://artifacts.apis.io/qodex/json-schema/qodex-post-auth-login-response-schema.json
- **JSONSchema** — https://artifacts.apis.io/qodex/json-schema/qodex-post-api-projects-my-project-slug-webhooks-trigger-response-schema.json

## Other QodexAI APIs (1)

- [Qodex API](https://apis.io/apis/qodex/qodex-api-2/)

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/qodex/qodex-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/qodex/.