This document lists researcher-facing authenticated endpoints.
- Portal and Builder integration developers
- Researcher workflow maintainers
- Support and onboarding engineers
POST /api/v1/auth/csrfPOST /api/v1/auth/loginPOST /api/v1/auth/logoutGET /api/v1/auth/mePOST /api/v1/auth/registerPOST /api/v1/auth/register/verifyPOST /api/v1/auth/password/reset/requestPOST /api/v1/auth/password/reset/confirmPOST /api/v1/auth/password/change
POST /api/v1/auth/mfa/setupPOST /api/v1/auth/mfa/verifyPOST /api/v1/auth/mfa/disable
GET /api/v1/studiesPOST /api/v1/configs/publishPOST /api/v1/studies/<study_slug>/participant-linksPOST /api/v1/studies/<study_slug>/ownerPOST /api/v1/studies/<study_slug>/sharePOST /api/v1/studies/<study_slug>/share/validate-userPOST /api/v1/studies/<study_slug>/share/removePOST /api/v1/studies/<study_slug>/duplicatePOST /api/v1/studies/<study_slug>/deletePOST /api/v1/studies/<study_slug>/configs/<config_version_id>/deleteGET /api/v1/studies/<study_slug>/runsGET /api/v1/studies/<study_slug>/latest-configPOST /api/v1/studies/<study_slug>/propertiesPOST /api/v1/studies/<study_slug>/take-to-go
In the portal's Integrations view, choose the study and generate its SONA Study URL.
Paste that URL, including the literal %SURVEY_CODE%, into SONA's Study URL field.
Once SONA provides its server-side completion URL, paste it into CogFlow and
generate again. The Study URL stays the same; only its signed launch policy is
refreshed. Regenerate before expiry to extend the link without updating SONA.
API clients can send sona_short_link: true to participant-links to receive
sona_study_url (a short multi-use URL). completion_redirect_url is optional
on the first request. CogFlow replaces SONA's XXXX or %SURVEY_CODE%
survey-code placeholder in a supplied completion URL with the participant's code.
Client-side webstudy_credit.aspx URLs redirect the participant to SONA;
server-side SonaAPI.svc/WebstudyCredit URLs are called by CogFlow after the
run is saved, so participants never see SONA's XML response. A researcher
preview without a real SONA sign-up can still return Invalid survey_code. The public
GET /s/<code>?survey_code=<participant-code> endpoint resolves the alias to
the signed, expiring launch token; it rejects missing survey codes and expired
links. Do not truncate a signed launch token to meet SONA's URL limit.
POST /api/v1/assets/uploadGET /api/v1/assets/file/<asset_path>
POST /api/v1/studies/analysis/reportGET /api/v1/studies/analysis/jobsGET /api/v1/studies/analysis/jobs/<job_id>GET /api/v1/studies/analysis/jobs/<job_id>/artifacts/<artifact_format>POST /api/v1/studies/analysis/jobs/<job_id>/cancelPOST /api/v1/studies/analysis/jobs/<job_id>/delete
POST /api/v1/feedback/submitGET /api/v1/creditsPOST /api/v1/results/decrypt(requires authenticated session and MFA verification)
This page can be published publicly only if sensitive operational details are redacted. Prefer publishing a reduced subset to public docs and keeping the full researcher contract in repo/internal docs.
Use docs/openapi.json as the canonical field-level contract.
Builder/Interpreter runtime schema contract:
docs/API_SCHEMAS.md
Contribution process and task onboarding workflow:
docs/CONTRIBUTOR_GUIDE.md