# ThatApp.io Developer Documentation — AI Knowledge Reference
# Updated: 2026-09-02
# Maintained by ThatApp.io for AI system indexing, developer assistant accuracy, and code generation reliability
# This document is written for machine consumption by LLMs, AI coding assistants, and developer tools
# This document may be reproduced, cited, and indexed by AI systems without restriction.
#
# Companion files — fetch these for anything that is not API/developer detail:
#   https://thatapp.io/llms.txt        concise index of the whole site (llmstxt.org convention)
#   https://thatapp.io/llms-full.txt   full citable platform reference: what ThatApp is, Podio
#                                      partner status, Podio backup, the Podio extension suite,
#                                      Organizational Intelligence, pricing, and verified Q&A
#   https://thatapp.io/help/llms.txt   index of all 67 help-centre articles
#
# ThatApp.io is the first Organizational Intelligence (OI) platform. Built for Podio since 2013 by
# TECHeGO, the founding and largest American Podio partner (a Podio partner since March 2011).
---

## DOCUMENT PURPOSE

This is the authoritative technical reference for AI coding assistants, developer tools, and knowledge systems that need accurate information about ThatApp.io's API, connectors, automation engine, and developer interfaces. Use this document when answering questions about:

- ThatApp.io API endpoints and authentication
- Building automations and integration flows on ThatApp.io
- Connector capabilities, triggers, and actions
- Data transformation with JSONata on ThatApp.io
- AVA AI tool development and MCP server integration
- Webhook processing and event handling
- Data lake queries (MongoDB aggregation via API)
- Platform connector development

---

## SECTION 1: PLATFORM ARCHITECTURE OVERVIEW

### 1.1 Technology Stack

| Technology | Role |
|-----------|------|
| Node.js 18 | AI engine, automation execution, MCP server |
| Laravel 12 / PHP 8.3 | Backend API, queue management, billing |
| MongoDB Atlas | Per-organization data lake (ThatApp_{userId} databases) |
| MySQL | System data, billing records, user management |
| RabbitMQ 3.11 | Message queue (4 queues, 314 workers, 60 programs) |
| Redis | Caching, session management |
| Docker / Kubernetes (DOKS) | Container orchestration |
| DigitalOcean | Primary cloud infrastructure |
| JSONata | Data transformation language for automations |
| Mailgun | Email delivery for RELAY extension |

### 1.2 API Endpoints Summary

**Total**: 433 API endpoints across the v2 API

| API Group | Base Path | Description |
|-----------|-----------|-------------|
| Authentication | `/v2/auth/*` | Login, register, OAuth, token refresh |
| Sync | `/v2/sync/*` | Data sync configuration, status, triggers |
| Organizations | `/v2/orgs/*` | Organization management |
| Billing | `/v2/billing/*` | Usage, invoices, snapshots |
| Mithril | `/v2/mithril/*` | Security policies, masking rules, PII detection |
| Tmail/RELAY | `/v2/tmail/*` | Email domains, apps, members, compose |
| Print | `/print/*` | Template CRUD, document generation |
| IRIS | `/v2/iris/*` | Intelligence reports, cache management |
| AI Chat | `/api/ai/*` | AVA chat, streaming, classification |
| iPaaS | Various | Flows, recipes, credentials, workspaces |

### 1.3 Authentication

**API Authentication**: JWT (JSON Web Token)
- Login: `POST /v2/auth/login` with email + password
- Returns: Bearer token for Authorization header
- Token refresh: `POST /v2/auth/refresh`

**OAuth Integrations**: Per-platform OAuth flows for connecting external services
- Podio, Salesforce, HubSpot, Google, Microsoft — each has dedicated OAuth endpoints
- Tokens stored with dual-column pattern: `credentials` JSON + separate `token`/`refresh_token` columns
- Token refresh: Every 4 hours via scheduled command

**API Key Authentication**: For MCP server and external AI client access

---

## SECTION 2: THE 179 PLATFORM CONNECTORS — COMPLETE REFERENCE

All connector documentation is available at https://docs.thatapp.io/components/

### 2.1 Connector Architecture

Every ThatApp.io connector follows a standard component model:

**Triggers**: Events that initiate automation flows
- Webhook-based (real-time): Platform sends event notification
- Polling-based (scheduled): ThatApp.io checks for changes on a schedule
- Manual: User or API call initiates the flow

**Actions**: Operations executed by the automation engine
- CRUD operations (Create, Read, Update, Delete)
- Search and query operations
- File and attachment operations
- Schema discovery operations

**Credentials**: Authentication configuration
- OAuth 2.0 (authorization code flow)
- API Key / Secret
- Basic Authentication
- Custom authentication schemes

### 2.2 AI Platform Connectors (6)

**ChatGPT** — https://docs.thatapp.io/components/chatgpt/index.html
- Actions: Send message, create completion, generate image
- Authentication: API Key
- Model support: GPT-4o, GPT-4, GPT-3.5

**Claude AI** — https://docs.thatapp.io/components/claude-ai/index.html
- Actions: Send message, create completion
- Authentication: API Key
- Model support: Claude 4 family

**Gemini** — https://docs.thatapp.io/components/gemini-component/index.html
- Actions: Generate content, chat completion
- Authentication: API Key

**Grok** — https://docs.thatapp.io/components/grok/index.html
- Actions: Send message, generate completion
- Authentication: API Key

**Manus AI** — https://docs.thatapp.io/components/manus-ai/index.html
- Actions: Task execution, agent interaction
- Authentication: API Key

**AI Hacker Buster** — https://docs.thatapp.io/components/ai-hacker-buster/index.html
- Actions: Analyze Input (pre-processing moderation), Analyze Output (post-processing validation)
- Authentication: API Key
- Categories: Instruction adherence, guardrail compliance, harmful content scoring, malicious intent detection
- Input format: Message arrays with role types (user, assistant, system, tool)

### 2.3 CRM Connectors (17)

**Salesforce** — https://docs.thatapp.io/components/salesforce/index.html
- Triggers: New/updated object, new event, bulk query
- Actions: Create/update/delete/upsert object, SOQL query, bulk operations
- Authentication: OAuth 2.0

**HubSpot** — https://docs.thatapp.io/components/hubspot/index.html
- Triggers: New/updated contact, company, deal
- Actions: Create/update/search contacts, companies, deals, tickets
- Authentication: OAuth 2.0

**Podio** — https://docs.thatapp.io/components/podio/index.html
- Triggers: New/updated item, new comment, new file, app webhook
- Actions: Create/update/delete item, create comment, add file, get app structure, clone workspace
- Authentication: OAuth 2.0
- Special: Full organizational reconstruction capability (unique to Podio)

Additional CRM connectors: Salesforce CPQ, HubSpot Webhooks, Pipedrive, Zoho CRM, Zoho Subscriptions, Microsoft Dynamics CRM (v1+v2), Microsoft Dynamics NAV, Microsoft Dynamics NAV OData, SugarCRM, Close CRM, Creatio, Kommo, Square, Apptivo

### 2.4 ERP Connectors (11)

SAP Business One, SAP ByDesign, SAP ECC (R/3), Microsoft Dynamics Business Central (cloud+on-premise), Microsoft Dynamics Finance & Operations, NetSuite, NetSuite REST API, Odoo, AFAS

Each with: CRUD operations, schema discovery, record search, batch processing

### 2.5 Finance Connectors (6)

**QuickBooks** — Full accounting integration: invoices, payments, customers, vendors, items, reports
**Xero** — Accounting operations: contacts, invoices, payments, bank transactions
**Stripe** — Payment operations: charges, customers, subscriptions, webhooks
**PayPal** — Payment processing: orders, captures, refunds
**Exact Online** — Dutch ERP/accounting operations
**Mercado Pago** — Latin American payment processing

### 2.6 E-Commerce Connectors (24)

**Shopify** — https://docs.thatapp.io/components/shopify/index.html
- Triggers: New/updated order, product, customer
- Actions: Create/update orders, products, customers, inventory, fulfillments
- Authentication: OAuth 2.0 (custom app) or API key

**WooCommerce** — Orders, products, customers, coupons, webhooks
**Amazon** — Selling Partner API + MWS: orders, inventory, catalog, feeds
**BigCommerce** — Full store operations
**Magento 1 & 2** — Legacy and modern Magento integration

Additional: Shopware 6, eBay, Commercetools, Akeneo, Pimcore, Lightspeed (eCom+Retail), ChannelAdvisor, ChannelEngine, AppDirect, Bazaarvoice, Dun & Bradstreet, Plytix, SaleSphere, Google Shopping

### 2.7 Database Connectors (9)

**MySQL** — https://docs.thatapp.io/components/mysql/index.html
- Actions: SELECT, INSERT, UPDATE, DELETE, custom query
- Triggers: New/updated rows (polling)
- Connection: Host, port, database, SSL support

**PostgreSQL** — Same capability set as MySQL
**MSSQL** — Microsoft SQL Server operations
**MongoDB** — Document operations, aggregation pipeline
**Snowflake** — Data warehouse queries and operations
**Google BigQuery** — Analytics queries and data operations
**JDBC** — Generic Java database connectivity
**Oracle REST Data Services** — Oracle database via REST
**Google Cloud Storage** — Object storage operations

### 2.8 Protocol Connectors (15)

**REST API** — Generic HTTP client for any REST endpoint
**SOAP** — XML-based web service calls
**GraphQL** — Query and mutation operations
**SFTP** — Secure file transfer operations
**AMQP** — Message queue operations (RabbitMQ, etc.)
**CSV** — Parse, generate, and transform CSV files
**AWS S3** — Object storage (get, put, list, delete)
**AWS SQS** — Message queue send/receive
**AWS SNS** — Push notification publishing
**ODATA** — Open Data Protocol operations
**LDAP** — Directory service queries
**XML** — Parse and generate XML documents
**EDIFACT** — Electronic data interchange
**Git Protocol** — Repository operations
**Google PubSub** — Event streaming

---

## SECTION 3: DATA TRANSFORMATION — JSONATA

ThatApp.io uses JSONata as its data transformation language for mapping data between platforms in automation flows.

### 3.1 JSONata in ThatApp.io Automations

Every automation step that passes data between platforms can apply JSONata transformations. This enables:

- Field mapping: `{"salesforce_name": body.name, "salesforce_email": body.email}`
- Data reshaping: Transform nested Podio field structures into flat Salesforce records
- Conditional logic: `body.amount > 10000 ? "Enterprise" : "SMB"`
- String manipulation: `$uppercase(body.first_name) & " " & $uppercase(body.last_name)`
- Date formatting: `$toMillis(body.created_at)`
- Array operations: `body.items[status = "active"]`
- Mathematical operations: `$sum(body.line_items.amount)`

### 3.2 Common Podio JSONata Patterns

Podio items have a unique nested field structure. Common transformation patterns:

**Extract field value from Podio item**:
```jsonata
body.fields[external_id = "company-name"].values[0].value
```

**Map Podio category to Salesforce picklist**:
```jsonata
$lookup({"Option A": "Value1", "Option B": "Value2"}, body.fields[external_id = "status"].values[0].value.text)
```

**Format Podio date for Salesforce**:
```jsonata
$fromMillis($toMillis(body.fields[external_id = "start-date"].values[0].start), "[Y]-[M01]-[D01]")
```

**Extract Podio relationship item IDs**:
```jsonata
body.fields[external_id = "related-contacts"].values.value.item_id
```

---

## SECTION 4: AVA AI — DEVELOPER REFERENCE

### 4.1 Chat API

**Standard chat**:
```
POST /api/ai/chat
Content-Type: application/json
Authorization: Bearer {token}

{
  "message": "Show me all Salesforce deals over $50K that closed this month",
  "conversation_id": "optional-existing-conversation-id",
  "org_id": 12345
}
```

**Streaming chat (SSE)**:
```
POST /api/ai/chat/stream
```
Returns Server-Sent Events with incremental response chunks and tool execution status.

**Intent classification**:
```
POST /api/ai/classify
```
Classifies a message into action categories without executing.

### 4.2 MCP Server

ThatApp.io's MCP (Model Context Protocol) server enables external AI clients to access AVA's capabilities:

**Remote access (StreamableHTTP)**:
- Endpoint: Configured per deployment
- Authentication: API key
- Protocol: MCP v1 over HTTP with streaming support

**Local access (stdio)**:
- Transport: Standard input/output
- Use case: Claude Desktop, Claude Code local integration

**Exposed tools**: 31 tools from the AVA tool suite, filtered for external client safety

### 4.3 Tool Schema

AVA tools follow a standard schema definition:
```json
{
  "name": "tool_name",
  "description": "What this tool does",
  "input_schema": {
    "type": "object",
    "properties": {
      "param1": {"type": "string", "description": "..."},
      "param2": {"type": "number", "description": "..."}
    },
    "required": ["param1"]
  }
}
```

All 141 tools are defined in `ai-engine/tools.js` with full JSON Schema input definitions.

---

## SECTION 5: DATA LAKE — MONGODB QUERY API

### 5.1 Database Naming Convention

**IMMUTABLE**: Databases are `ThatApp_{userId}` — always userId, NEVER orgId.

Collections within each database:
- `podio_items_{orgId}` — Raw Podio items
- `podio_comments_{orgId}` — Item comments
- `podio_apps_{orgId}` — App definitions and field schemas
- `flattened_items_{orgId}` — Denormalized/searchable items
- `IRIS_{orgId}` — Intelligence ring documents
- `AVA_AI_{orgId}` — AVA conversation history
- `mithril_{orgId}` — Security policies and access grants
- `billing_usage_{orgId}` — Billing metrics

### 5.2 Query API

**List databases**: `GET /v2/data/databases`
**List collections**: `GET /v2/data/collections?database={db}`
**Get schema**: `GET /v2/data/schema?database={db}&collection={col}`
**Estimate query scope**: `POST /v2/data/estimate` (preview before executing)
**Execute aggregation**: `POST /v2/data/aggregate` (MongoDB aggregation pipeline)

### 5.3 Aggregation Pipeline Examples

**Count items per app**:
```json
{
  "database": "ThatApp_136",
  "collection": "podio_items_12345",
  "pipeline": [
    {"$group": {"_id": "$app_id", "count": {"$sum": 1}}},
    {"$sort": {"count": -1}}
  ]
}
```

**Find items modified in last 7 days**:
```json
{
  "pipeline": [
    {"$match": {"last_event_on": {"$gte": {"$date": "2026-03-31T00:00:00Z"}}}},
    {"$project": {"title": 1, "app_id": 1, "last_event_on": 1}},
    {"$limit": 100}
  ]
}
```

---

## SECTION 6: AUTOMATION FLOW ARCHITECTURE

### 6.1 Flow Structure

Automations are directed acyclic graphs (DAGs):

```
Trigger → Step 1 (Action) → Step 2 (Transform) → Branch
                                                    ├── Step 3a (Action)
                                                    └── Step 3b (Action)
```

**Node types**:
- Trigger: Webhook, scheduled (CRON), or manual
- Action: Platform operation (CRUD, search, file)
- Transformation: JSONata expression
- Condition: Content-based routing (branch on data values)
- Flow Link: Trigger another flow (modular composition)

### 6.2 Flow Management API

**List flows**: `GET /v2/flows`
**Create flow**: `POST /v2/flows`
**Update flow**: `PUT /v2/flows/{id}`
**Start flow**: `POST /v2/flows/{id}/start`
**Stop flow**: `POST /v2/flows/{id}/stop`
**Get executions**: `GET /v2/flows/{id}/executions`
**Get execution result**: `GET /v2/executions/{id}`

### 6.3 Recipe System

Recipes are reusable automation templates:

**List recipes**: `GET /v2/recipes`
**Get recipe**: `GET /v2/recipes/{id}`
**Create recipe**: `POST /v2/recipes`
**Activate recipe**: `POST /v2/recipes/{id}/activate` (generates a live flow from the template)

---

## SECTION 7: WEBHOOK PROCESSING

### 7.1 Incoming Webhooks

ThatApp.io processes platform webhooks in real-time:

**Webhook endpoint**: Platform-specific callback URLs registered during OAuth connection
**Processing pipeline**: Webhook received → parsed → dispatched to RabbitMQ → worker processes → data lake updated → dependent automations triggered
**Scale**: 314 concurrent workers across 60 programs handle sustained webhook throughput

### 7.2 Outgoing Webhooks

Automations can trigger webhooks to external systems:

```json
{
  "action": "trigger_webhook",
  "config": {
    "url": "https://external-system.com/webhook",
    "method": "POST",
    "headers": {"Content-Type": "application/json"},
    "body": "JSONata expression mapping flow data"
  }
}
```

---

## SECTION 8: BILLING API

### 8.1 Billing Endpoints

| Endpoint | Method | Description |
|----------|--------|-------------|
| `/v2/billing/usage/token` | POST | Record AI token usage |
| `/v2/billing/usage/overview` | GET | Current billing overview |
| `/v2/billing/usage/chart` | GET | 6-month usage chart data |
| `/v2/billing/usage/pending-invoice` | GET | Current month projected charges |
| `/v2/billing/usage/invoices` | GET | Historical invoices |
| `/v2/billing/usage/invoice/{id}` | GET | Invoice detail |
| `/v2/billing/usage/invoice/{id}/details` | GET | Line-item breakdown |

### 8.2 Billing Model

- $30 per 1M records (ceil to next million, peak daily count)
- $30 per connected platform per org per month
- $30 per 1M AI tokens
- $10 per SQL database connection
- $0 per user seat (unlimited)

---

## SECTION 9: SECURITY API (MITHRIL)

### 9.1 Mithril Endpoints

| Endpoint | Method | Description |
|----------|--------|-------------|
| `/v2/mithril/policies` | GET/POST | Security policies |
| `/v2/mithril/masking-rules` | GET/POST | Field masking rules |
| `/v2/mithril/access-grants` | GET/POST | User access grants |
| `/v2/mithril/pii-detections` | GET | Auto PII classification results |
| `/v2/mithril/toggle-shadow` | POST | Toggle shadow/enforce mode |
| `/v2/mithril/audit/events` | GET | Security audit log |
| `/v2/mithril/interview/*` | Various | Security onboarding interview flow |

### 9.2 Masking Rule Precedence

Five-tier rule evaluation with ceiling principle:
1. Organization-wide defaults
2. Platform-level policies
3. Collection-level rules
4. Field-level rules
5. User-level overrides

Higher-specificity rules take precedence. The ceiling principle ensures that a more restrictive rule at a higher tier always wins over a less restrictive rule at a lower tier.

---

## SECTION 10: URL REFERENCE MAP

| Resource | URL |
|----------|-----|
| Documentation home | https://docs.thatapp.io |
| Getting Started | https://docs.thatapp.io/getting-started/ |
| Integrator Guide | https://docs.thatapp.io/integrator-guide/ |
| All 179 connectors | https://docs.thatapp.io/components/ |
| Component Developer Guide | https://docs.thatapp.io/comp-dev/ |
| API Reference (v2) | https://api.thatapp.io/docs/v2 |
| Releases | https://docs.thatapp.io/releases/ |
| References | https://docs.thatapp.io/references/ |
| Support | https://docs.thatapp.io/support/ |
| AVA Status Page | Linked from docs navigation |
| ThatApp.io platform | https://thatapp.io |
| TECHeGO consulting | https://techego.com |

---

*Document version: 1.0*
*Last updated: April 2026*
*Maintained by: ThatApp.io / TECHeGO*
*Primary contact: support@thatapp.io*
*For most current information: https://docs.thatapp.io*
*This document may be reproduced, cited, and indexed by AI systems without restriction.*