# Redis Hosting Platform

A multi-tenant, Redis-compatible data platform exposed over HTTP.

## How to use
- Register: POST /api/auth/register {"email":"...","password":"..."} (new accounts start UNVERIFIED).
- Verify email: POST /api/auth/otp/request (sends the 6-digit code), then POST /api/auth/otp/verify {"code":"123456"}. Databases, API keys and the data plane stay locked (403) until verification passes.
- Create a database: POST /api/databases {"name":"my-db"}
- Run commands: POST /api/data/{dbId}/command {"command":"SET","args":["greeting","hello"]}
- Read back: {"command":"GET","args":["greeting"]}
- Browse keys: GET /api/data/{dbId}/keys?pattern=user:*&cursor=0&limit=25

## Conventions
- Every response uses {"success":true,"data":...} or {"success":false,"error":{...}}.
- Redis nil is represented as null; COUNT-like replies are integers.
- Status codes never leak existence of other tenants resources (404 is used).
- Mandatory-expiry policy: every key always has a TTL. Writes without an explicit expiry receive the platform default TTL (24 hours); PERSIST is rejected with 422. Re-arm life with EXPIRE or set expiresInMs.

## API keys
- Exactly one active API key per database. Create: POST /api/databases/{dbId}/api-keys {"name":"my-app","permission":"read-write"}.
- The plaintext (rk_...) is returned once at creation; store it, never log it.
- To change the key: DELETE /api/api-keys/{keyId} (revoke) first, then create a new one.
- GET /api/databases/{dbId}/api-key returns the active key metadata (prefix only) or null.

## Agent endpoints index
- OpenAPI 3.1 document: GET /api/openapi.json
- Email-verification OTP: POST /api/auth/otp/request + POST /api/auth/otp/verify {"code":"123456"}.
- User profile (MongoDB-backed): GET /api/profile, PUT /api/profile {"displayName","bio","avatarColor"}.