Public API — the short version.

Liveness + readiness probe. Returns service status, commit, dependency checks, and response time.

curl https://duelbond.com/api/health

• Returns 200 when status is 'ok', 503 when 'degraded'.
• Never cached — always hits the origin.

Inbound Stripe events — payment_intent.succeeded, charge.refunded, treasury.received_credit, treasury.outbound_payment.*.

• Requires a valid Stripe-Signature header; unsigned requests are rejected with 400.
• Idempotent on event.id — duplicate deliveries are safe.

Inbound biometric events from Terra (Apple Health / Health Connect / Oura / Fitbit / Garmin).

• Validates the x-terra-signature HMAC before processing.
• Only daily summaries are accepted; raw samples are rejected.

Submit a contact-form message. Rate-limited per IP.

curl -X POST https://duelbond.com/api/contact \
  -H "Content-Type: application/json" \
  -d '{"name":"Sam","email":"sam@example.com","topic":"general","message":"Hello"}'

Create a public challenge (requires session cookie).

• Session is session-cookie based — call from a browser context.
• Body: { title, blurb, stakeCents, durationDays, pillarIds[] }

Fetch a public challenge's title, stake, duration, and pillars.

curl https://duelbond.com/api/challenges/chg_01HX…

Create a signed contract. Internal — used by the /new wizard.

• Not yet stable. Schema will change before Pro API access is opened.

Download the signed PDF for a contract you're party to.

• Returns 404 if you're not signer or counterparty.
• Cache-Control: private; PDFs are signed per session.