> ## Documentation Index
> Fetch the complete documentation index at: https://docs.grouple.pro/llms.txt
> Use this file to discover all available pages before exploring further.

# API Routes

> Backend API routes served from api.grouple.pro

## Overview

The backend API (`server/index.ts`) serves routes defined in `server/routes/`. It acts as a middleware layer between the frontend and external services (Bedrock, Textract), and handles operations that require server-side credentials or processing that shouldn't happen client-side.

## Route Files

### `server/routes/demo.ts`

Current route definitions. The API is intentionally lean — most data operations go directly through the Supabase client on the frontend (with RLS enforcing security).

## When Does the API Get Called?

The frontend uses the ECS API for operations that require:

1. **Server-side credentials** (Bedrock API keys, service role keys)
2. **Heavy processing** (triggering AI workers, PDF processing)
3. **Webhook handling**

For all standard CRUD (read venues, submit enquiries, manage proposals), the frontend calls **Supabase directly** using the JS client with JWT auth — the ECS API is bypassed entirely.

## Request Flow

```
Frontend makes API request
        ↓
Authorization: Bearer <supabase_jwt>
        ↓
api.grouple.pro → ALB → ECS API Container
        ↓
Server validates JWT with Supabase
        ↓
Processes request (calls Bedrock / triggers worker / etc.)
        ↓
Returns response to frontend
```