A machine-readable openapi.json spec is generated automatically from the route registry · interactive docs at /api-docs
→
Interactive Scalar API explorer
Browse, try, and send live requests to every endpoint straight from the docs
→
API keys
API key manager to let external applications securely access your data. Keys can auto-expire.
→
Zod validation + rate limiting
All endpoints validated · 5 sign-ins / 5 min · 3 sign-ups / 5 min · 5 TOTP verifies / min
04GUARDRAILS
Security & permissions - every request passes through here
Isolation model (docs/SECURITY.md): middleware auth → API-layer filtering → RLS. Also: AES-256-GCM encrypted secrets at rest · disabled-account lockout (sessions rejected, API keys stop working).
→
Session middleware
Every route authenticated by default · security headers (CSP · HSTS · X-Frame-Options · X-Content-Type-Options · Referrer-Policy · Permissions-Policy)
→
Account security
Argon2id · 18-char min passwords · TOTP MFA · rate limiting & brute-force protection · public sign-up disabled at the middleware
→
Roles & permissions
Admin/user roles · granular keys · always resolved fresh from the DB, never the cookie-cached session
→
Audit Logs
Every user and system action is tracked and timestamped for full visibility and accountability
→
Tenant isolation
Per-user vs shared data model · API-layer user_id filtering
→
Encrypted Tunnels
Open a temporary, encrypted public HTTPS URL to your local ARI instance with one flag · no open ports, no firewall changes · the URL vanishes the moment ARI stops
01MODULES
Modules
Each module code is entirely self-contained in its own directory, which means they are fully portable. Fork them and share with colleagues.
Modules can declare their own npm dependencies (auto-installed on module install).
ARI supports trusted native modules with unrestricted flexibility and guardrailed modules with enforced isolation and permissions.
Simply describe the module you want and ARI automagically creates it - scaffolding, schema, API, and UI wired into the platform for you. Every module is generated from one canonical template - same structure, same API shape, with auth, validation, RLS, and theming inherited automatically. Committed CLAUDE.md / AGENTS.md rules steer any AI builder, so the architecture is enforced, not left to convention.
→
ARI Module Library
Premium module distribution via api.ari.software, unlocked by license key. Modules hosted on private Cloudflare R2.
→
Idempotent Module Updates
Automatic self-healing updates · dependency health handled automatically, auto-installed on module install (with version-conflict detection)
→
Module semver versioning
Every module declares its own major.minor.patch version · updates are compatibility-checked before install, and breaking changes require an explicit major-version upgrade
Update-aware guard · stale build caches detected & cleared automatically · no manual resets after updates
→
Health diagnostics
Automatic 355+ health checks to proactively detect issues.
→
Telemetry
lib/telemetry
→
Tenant Isolation
Per-tenant data separation · scoped queries · isolated storage
→
Deploy anywhere
localhost · LAN · one-click Vercel Deploy Button (boots with zero env vars) · Supabase Cloud — guided /welcome setup wizard configures the database, admin account, and secrets on first visit
05STORAGE
Storage Control
Choose the data layer that fits your security and infrastructure model
Database - row-level security + Drizzle ORM
→
PostgreSQL
3 interchangeable backends: local Postgres · local Supabase · Supabase Cloud (ARI_DB_MODE)
→
withRLS()
On every query - defense-in-depth; API-layer filtering is the real tenant boundary
→
Idempotent schema
lib/db/setup.sql + per-module schema.sql, auto-applied on boot/enable
Media Storage Layer
→
Filesystem (default)
data/storage/{user_id}/{bucket}/
→
AWS S3
Native S3 buckets
→
Cloudflare R2
S3-compatible
→
Supabase Storage
S3-compatible
Authenticated endpoints only (/api/storage/…) - no public file URLs.