# Mesta Dataroom > Mesta is a private virtual data room (VDR) for confidential deal documents; every room is invite-only. This file holds the full developer portal documentation; request and response schemas are in the public developer portal at /developers. ## Documentation ### Overview Share confidential deal documents with buyers, investors and auditors, and know who read what. Guides, API reference and agent tooling in one place. #### What Mesta is Mesta is a virtual data room (VDR): a place to share confidential documents with people outside your company during a deal, such as an acquisition, a fundraise or an audit, while keeping a record of who did what. Everything lives inside an organization. Each sign-up creates a new organization with the person who signed up as its owner, and one account can belong to several organizations. Anyone in an organization can create a data room in it and becomes the room's owner. The room owner and the organization's owners and admins decide who, from inside or outside the company, is let into each room. #### How a room protects its documents Every document passes several checks before anyone else can read it: - **Access**: only the room owner and invited members open a room's documents. The organization's owners and admins manage the room (members, NDA, status, audit) but read its documents only after adding themselves as members, which is recorded in the member list and the audit log. Rooms and documents you can't access answer "not found" rather than revealing that they exist. - **NDA gate**: a room can require everyone, its owner included, to accept a non-disclosure agreement before any document opens. - **Malware scan**: uploads are scanned, and a file is only previewed or downloaded once its scan is clean. - **Watermarks**: previews and PDF downloads carry the viewer's email, the time and the document id, so a leaked copy points back to its source. - **Audit log**: downloads, uploads, deletions, restores, NDA acceptances and permission changes are recorded for the room owner and the organization's admins. Sign-ins are listed separately under **Sessions**. ### Quickstart From sign-up to a shared room, then the same from the API. #### 1. Create your organization Open [Create an organization](https://vdr.mesta.click/signup) and enter your name, organization, work email and a password of 12 to 128 characters. Mesta emails a verification link that stays valid for 24 hours; you can sign in once the address is verified. #### 2. Create a data room In **All data rooms**, create a room. Its status starts as `draft`; change it on the room's **Overview**. `draft` and `active` are labels and behave the same: members see the room as soon as they are added. `archived` makes the room read-only (no uploads, deletions or new folders) while everyone keeps their access. #### 3. Add folders and documents Build the index under **Folders**, then upload under **Documents**. Each file is scanned for malware before it can be opened. Executables and scripts are refused; macro-enabled Office files are accepted but flagged with a Macros badge. #### 4. Set an NDA (optional) Set the agreement text through the API with [Set or clear the room's NDA text](https://vdr.mesta.click/developers#setNdaText). Members then read and accept it on the room's **NDA** page before any document opens. ``` curl -X PUT "https://vdr.mesta.click/api/rooms//nda" \ -H "Cookie: auth_token=$MESTA_TOKEN" \ -H "Content-Type: application/json" \ -d '{"nda_text":"By continuing you agree to keep every document in this room confidential."}' ``` #### 5. Invite people Organization admins create accounts for colleagues under **Users**. Then the room owner or an organization admin adds people to a room under **Members**, by email, with a permission level: `view`, `download`, `upload` or `manage`. This applies to colleagues too: a standard user only sees the rooms they own or were added to. People from other companies need their own Mesta account first. #### 6. Watch the activity The **Audit Log** (organization admins) shows who downloaded, uploaded, deleted and changed what, **Sessions** lists sign-ins with their location and risk, and **Access Review** lists every membership and admin for periodic recertification. #### The same from the API Sign in from your script, keep the token, and call the room endpoints. See [Authenticate with the API](https://vdr.mesta.click/developers#guide-auth) for the details. ``` export MESTA_TOKEN=$(curl -s -o /dev/null -D - -X POST "https://vdr.mesta.click/api/auth/login" \ -H "Content-Type: application/json" \ -d '{"email":"you@company.com","password":""}' \ | grep -i '^set-cookie: auth_token=' | cut -d= -f2 | cut -d';' -f1) curl -X POST "https://vdr.mesta.click/api/rooms" \ -H "Cookie: auth_token=$MESTA_TOKEN" \ -H "Content-Type: application/json" \ -d '{"name":"Project Atlas"}' ``` ### Glossary The terms used across Mesta and its API. - **Organization**: a tenant. An account can belong to several, with an organization role in each: `owner`, `admin` or `member`. Admin rights stop at the organization's boundary. An organization is `active` or `suspended`; the rooms of a suspended organization are closed to everyone. - **Home organization**: the organization an account signed up in or was created in, shown in the app. It grants nothing by itself; a guest who was only invited into rooms has none. - **Organization admin**: an `owner` or `admin` of an active organization. Invites users, manages every room of the organization (members, NDA, status, deletion, room audit) and reads its audit log, sessions and access review. The role gives no access to room documents: an admin who needs them adds themselves as a room member, which is visible and audited. - **Standard user**: organization role `member`. Sees only the rooms they own or were added to. - **Guest**: a person from another organization who was added to a room. Guests see only the rooms they belong to. - **Operator**: Mesta platform staff (profile role `operator`). Operators work in a separate console that shows metadata only, never document content, and cannot sign in to the data room app. - **Data room (room)**: a container of folders and documents with its own members, NDA and audit trail. Status is `draft`, `active` or `archived`; only `archived` changes behaviour, by making the room read-only. - **Room owner**: the account that created the room. Has `manage` plus control of the room: its members, NDA, status, deletion and room audit. - **Room member**: an account added to a room with a permission level. - **Permission level**: `view` (preview only), `download`, `upload` or `manage`, granted per room. It applies to every folder and document in the room. - **NDA gate**: room setting that blocks documents until each person, the owner and organization admins included, accepts the NDA text. - **Scan status**: `pending`, `clean`, `malicious`, `error`, `skipped` or `unknown`. Only `clean` files are previewed or downloaded. - **Watermark**: the viewer's email, the time and the document id burned into previews and PDF downloads. - **Trash**: deleted documents stay restorable for 30 days, then are removed for good. - **Destruction log**: the record kept when a file is permanently removed (certificate-of-destruction trail). - **Audit log**: the record of downloads, uploads, deletions, restores, NDA acceptances and changes, and permission changes. - **Access review**: the report of every room membership and admin, used to recertify who still needs access. - **Semantic search**: meaning-based search over a room's indexed documents. - **Knowledge graph**: organizations, people, agreements, financial terms, assets, jurisdictions, regulations and dates extracted from a room's documents and linked together. - **DD category**: the due-diligence category assigned to each indexed document, such as `Finance / Tax`. ## Guides ### Authenticate with the API Signing in from a script, the session cookie and the User-Agent check. Production traffic goes through the web app at `https://vdr.mesta.click/api`. Sign in with `POST /api/auth/login` ([Sign in](https://vdr.mesta.click/developers#login)): the web app returns the token in the `auth_token` cookie (the `Set-Cookie` response header), not in the body. Send it back on every other call as `Cookie: auth_token=`; a bearer header alone is refused with 401. The token is an HS256 JWT valid for 24 hours. There is no refresh endpoint: sign in again when it expires. Suspending a user, or revoking their sessions, invalidates their tokens at once. Accounts must have a verified email, otherwise sign-in answers 403 `email_not_verified`; operator accounts are refused with 403 `operator_account`. Guests without an organization of their own sign in normally. #### Use one client with a fixed User-Agent The token carries a hash of the User-Agent that signed in, and the web app checks it on every request. A token presented with a different User-Agent looks like a stolen cookie: Mesta ends every session of the account and emails the user. Sign in from the script or service that makes the calls, set its User-Agent explicitly so a library upgrade can't change it, and never copy a token out of a browser. #### Quick start ``` export MESTA_TOKEN=$(curl -s -o /dev/null -D - -X POST "https://vdr.mesta.click/api/auth/login" \ -H "Content-Type: application/json" \ -d '{"email":"you@company.com","password":""}' \ | grep -i '^set-cookie: auth_token=' | cut -d= -f2 | cut -d';' -f1) curl "https://vdr.mesta.click/api/rooms" -H "Cookie: auth_token=$MESTA_TOKEN" ``` #### Calling the API directly A self-hosted deployment can also reach the API itself (in local development, `http://localhost:3001`). There `POST /auth/login` returns the token as `access_token` in the body, and calls send it as `Authorization: Bearer `; the User-Agent check is done only by the web app. The web app forwards every operation except the destruction log and the internal session-mismatch call, which exist only on the API itself. Pick the server in the API reference toolbar and the samples switch between the two styles. ### Upload and share documents File rules, malware scanning, previews and watermarked downloads. Upload with a multipart `POST` to [Upload a document](https://vdr.mesta.click/developers#uploadDocument): a `file` part (with a filename) and an optional `folder_id`. You need `upload` or `manage` on the room. The request may be up to 100 MB. Some files are refused on name alone: executables and scripts (`.exe`, `.js`, `.hta`, `.lnk`, `.msi`, `.iso` and similar) and names containing text-direction control characters. Macro-enabled Office files (`.xlsm`, `.docm`, `.pptm`...) are accepted because financial models use macros, but the room owner and the organization's admins are emailed about them. #### Scanning A new document starts with scan status `pending`. Until it is `clean`, preview and download answer 409. A `malicious` file is blocked with 403 and, when deleted, skips the trash. A scan that fails is retried automatically, up to five attempts. After that, the uploader, `manage` members or the owner can [re-queue it](https://vdr.mesta.click/developers#rescanDocument). #### Previews and downloads [Preview](https://vdr.mesta.click/developers#previewDocument) renders one page as an image with the viewer's watermark, so `view` members can read without receiving the file. [Download](https://vdr.mesta.click/developers#downloadDocument) needs `download` or higher. PDFs are stamped with the viewer's email, the time and the document id; a PDF that can't be stamped (for example an encrypted one) and other file types download unchanged. #### Deleting and restoring The uploader, `manage` members and the owner can [delete](https://vdr.mesta.click/developers#deleteDocument) a document. It moves to the trash for 30 days, where `manage` members and the owner can [restore](https://vdr.mesta.click/developers#restoreDocument) it. After that it is removed for good and recorded in the [destruction log](https://vdr.mesta.click/developers#listDestructionLog). ### Members and permissions Who can see and do what in a room. Access to a room's documents comes from two places: the owner has full access to their room, and members get the level they were added with. Owners and admins of the room's organization manage the room but get no access to its documents from that role; one who needs them adds themselves as a member, which shows in the member list and the audit log. A member's level applies to every folder and document in the room; Mesta can't yet hide a folder from some members of a room. #### What each level allows - `view`: list and preview documents, search the room. - `download`: also download files. - `upload`: also upload files and create folders. - `manage`: also delete any document or folder, re-queue scans, restore from the trash and read the destruction log. - **Owner**: `manage`, and also add, change and remove members, set the NDA, change the room's status, delete the room and read the room audit. - **Organization owners and admins**: the same room management as the owner, without access to documents unless they are also members. #### Adding members The room owner or an organization admin [adds a member](https://vdr.mesta.click/developers#addMember) by email; the person needs a Mesta account, in any organization. Adding someone who is already a member only changes their level. Granting `manage` emails the room owner and the organization's admins, except whoever made the change. #### Need-to-know between bidders In [List room members](https://vdr.mesta.click/developers#listMembers), people who don't manage the room see only their own membership and the `manage` members from the room's organization. Everyone else, including other bidders, is hidden, so competing bidders in the same room cannot tell who else is looking. ### Require an NDA Gate a room's documents behind an agreement. An organization admin or the room owner [sets the NDA text](https://vdr.mesta.click/developers#setNdaText) through the API. While it is set, every member, the owner included, must [accept it](https://vdr.mesta.click/developers#acceptNda) on the room's **NDA** page before listing, previewing, downloading or searching documents; until then those calls answer 403 `nda_required`. Nobody is exempt: an organization admin who joins the room as a member accepts it too. Acceptances are recorded in the audit log. Changing the text clears every acceptance, so members accept the new version, and the change itself is audited; saving identical text keeps them. Saving an empty text removes the gate. ### Audit, sessions and access review Evidence of who did what, and who still has access. - [Audit log](https://vdr.mesta.click/developers#listAudit): the entries of every organization you own or administer, newest first, filterable by action. Organization admins only. - [Room audit](https://vdr.mesta.click/developers#roomAudit): one room's entries, for the room owner or organization admins, filterable by the resource they concern. - [Sessions](https://vdr.mesta.click/developers#listSessions): sign-ins with IP address, location and a risk rating. Organization admins see the members of the organizations they administer; everyone else sees their own. Sessions are kept for 12 months. - [Access review](https://vdr.mesta.click/developers#accessReview): every membership of those organizations' rooms and every owner and admin of them, with last sign-in and last activity, for periodic recertification. Organization admins only. ### Errors, pagination and limits What failures look like and how to page through lists. Errors are JSON `{"error": ""}`. The API answers malformed bodies rejected before the handler (400, 413, 415, 422) in plain text; through the web app they arrive wrapped as `{"error": ""}` too. - **404** often means "no access" rather than "missing": Mesta does not reveal rooms or documents you may not see. - **403** `nda_required`: accept the room's NDA first. - **409** on preview or download: the malware scan has not passed yet. - **429**: rate limited. Most routes allow 100 requests per 60 seconds per client IP and path; sign-in allows 5. #### Pagination Room, folder, document and session lists take `limit` and `offset`; the audit logs take `page` and `limit`. All of these return a `total`. Limits above the maximum are clamped, not rejected. The member list and access review return everything at once, and the trash and destruction log return their most recent 500 and 1,000 entries. ## Use cases ### Sell-side M&A due diligence Several bidders, one room, no leaks between them. The seller's team builds the index, sets an NDA and adds each bidder's advisers with `view` or `download`. Bidders cannot see each other in the member list, every preview and PDF carries the viewer's watermark, and the audit log shows which documents each bidder downloaded. Every indexed upload is filed under a due-diligence category, and the AI assistant answers questions across the room. ### Fundraising and investor updates Share the company's story with investors, room by room. One room per round keeps the deck, financial model and cap table together. Investors get `view` until a term sheet is signed and `download` afterwards. A member's level covers the whole room, so material meant only for the lead investor goes in a separate room that only they are added to. Archive the room when the round closes: it becomes read-only and everyone keeps their access. ### Audits and regulatory reviews Give auditors evidence without emailing attachments. Auditors join as guests with `view`, so they read watermarked previews without receiving files. The audit log and room audit prove what was provided and changed, access review supports quarterly recertification, and the destruction log records when evidence was permanently removed. ## Agents ### AI assistant The built-in agent that works inside a room. The assistant button in the bottom-right corner of the dashboard opens a chat about the room you are in. Before first use, each person accepts the AI terms, which list the services involved. It can search documents by name and by meaning, list folders, check your permission level, query the knowledge graph, scan an indexed document for personal data and hand longer reviews to a due-diligence reviewer sub-agent. Its searches go through the API with your account, so it can only reach rooms you have access to, after you accept the room's NDA. #### Redaction needs your approval Creating a redacted PDF always pauses for you to approve or reject. The redacted file is saved as a new copy named ` (redacted).pdf`; the original is never changed. Only the room owner and `manage` members can redact, and only PDFs are supported. #### Where document data goes Once an upload passes the malware scan (or immediately, when no scanner is configured), it is indexed: embeddings, text recognition, DD classification and knowledge-graph extraction. Indexing and assistant chats go through OpenRouter with provider data collection denied and zero data retention. Indexing runs for every such upload; the chat itself only answers people who accepted the AI terms. ### MCP server Room tools over the Model Context Protocol. `mesta-mcp-server` exposes read-only room tools over MCP (JSON-RPC 2.0 on stdio, protocol version `2024-11-05`): - `list_folders` `{room_id}`: the room's folder hierarchy. - `search_docs` `{room_id, query}`: documents whose name matches, up to 50. - `check_perms` `{room_id}`: your permission level in the room: `manage` (the owner counts as `manage`), `upload`, `download`, `view` or `none`. Each `tools/call` carries the user's Mesta token in `params._auth.token`, and the tools apply the same rules as the REST API. Revoked tokens (after a suspension or a session revocation) are refused. A room answers only to its owner and its members, while its organization is active; anyone else, organization admins included, gets `error: room … not found`. When the room has an NDA, `list_folders` and `search_docs` return `error: nda_required` until you accept it in Mesta. Nobody skips it, the room owner included. Deleted documents never appear. #### Running it The server connects to the Mesta database directly, so it runs next to your deployment, not on a laptop. It needs `DATABASE_URL` and `JWT_SECRET`. Mesta's agent service calls it over HTTP at `MCP_SERVER_URL`, which needs an HTTP-to-stdio bridge in front of the server (not part of this repository). Off-the-shelf MCP clients do not send `_auth`, so connecting one also needs a small proxy that adds the token. ``` cd backend && cargo run -p mesta-mcp-server # one request per line on stdin {"jsonrpc":"2.0","id":1,"method":"tools/list"} {"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"search_docs","arguments":{"room_id":"","query":"shareholder"},"_auth":{"token":""}}} ``` ### Agent Skills A ready-made skill that teaches an agent the Mesta API. An Agent Skill is a folder with a `SKILL.md` file that an agent loads when a task matches its description. The skill below teaches an agent how to sign in, which calls to use and how to behave around NDAs, access errors and pending scans. Save it as `.claude/skills/mesta-api/SKILL.md` in a project (or `~/.claude/skills/mesta-api/SKILL.md` for all projects) for Claude Code, or in the skills folder of any client that supports Agent Skills. Give the agent `MESTA_API_URL` and a token through the environment, never in the file. #### SKILL.md ``` --- name: mesta-api description: Work with a Mesta virtual data room through its REST API - list rooms, folders and documents, search a room, manage members and read audit logs. Use when the user asks to automate or query their Mesta data room. --- # Mesta data room API Base URL: $MESTA_API_URL (production: https://vdr.mesta.click/api). Every call except sign-up, sign-in, email verification and /health sends the token as a cookie: `Cookie: auth_token=$MESTA_TOKEN`. (A self-hosted API reached directly takes `Authorization: Bearer $MESTA_TOKEN` instead.) ## Sign in POST /auth/login with {"email", "password"}. Through the web app the token comes back in the `auth_token` Set-Cookie header, not in the body. Tokens last 24 h and there is no refresh endpoint: sign in again when one expires. The token is bound to the User-Agent that signed in. Send every call from the same client with the same User-Agent: a token presented with another User-Agent ends every session of the account and emails the user. Never reuse a token copied from a browser. ## Rules - Treat room contents as confidential. Do not paste document text outside the conversation the user started, and never try to work around an access error. - 404 on a room or document usually means "no access", not "missing". Do not probe other ids. - 403 {"error":"nda_required"}: the user must accept the room's NDA themselves (GET then POST /rooms/{id}/nda). Show them the NDA text; do not accept it on their behalf. - 409 on download or preview: the malware scan has not passed yet. Wait; do not retry in a loop. - PDF downloads are stamped with the user's identity. Say so before downloading. - Respect rate limits (100 requests per 60 s per client IP and path, 5 per 60 s for sign-in); back off on 429. ## Common calls - GET /rooms - rooms the user can see - GET /rooms/{id}/folders, GET /rooms/{id}/documents?limit=50&offset=0 - POST /rooms/{id}/semantic-search {"query_text": "change of control clause", "limit": 10} - GET /rooms/{id}/members, POST /rooms/{id}/members {"user_email", "permission_level"} - GET /rooms/{id}/audit (room owner or org admin) The full reference is the OpenAPI spec in the Mesta developer portal (/developers). ``` ### llms.txt and llms-full.txt Machine-readable summaries for AI crawlers and agents. Mesta publishes the [llms.txt convention](https://llmstxt.org/) at the site root, without sign-in: - [/llms.txt](https://vdr.mesta.click/llms.txt): what Mesta is, then one line per page of this portal linking to that page as Markdown. - `/docs/.md.txt`: each portal page on its own as Markdown, for example [/docs/quickstart.md.txt](https://vdr.mesta.click/docs/quickstart.md.txt). An agent reads only the pages it needs. - [/llms-full.txt](https://vdr.mesta.click/llms-full.txt): this portal's documentation in one file (overview, quickstart, glossary, guides, use cases, agents, FAQ) plus an index of every API operation. None of these files contains room data. The full API reference, with request and response schemas, is in this portal (no sign-in needed) and in the downloadable OpenAPI spec. ## FAQ ### Frequently asked questions Short answers to what people ask most. #### Why do I get "not found" for a room I know exists? You are not a member of it, or your access was removed. Mesta answers 404 instead of 403 so that rooms and documents are not revealed to people outside them. Organization admins see their organization's rooms in the list, but the documents answer 404 to them too until they add themselves as members. #### Why can't I open a document I just uploaded? It is still being scanned for malware. Preview and download unlock once the scan is `clean`. #### Can bidders in the same room see each other? No. Unless you manage the room, the member list shows only you and the seller's `manage` members. #### Can I hide one folder from some members? Not yet. A member's level covers the whole room, so put restricted material in a separate room. #### Are downloads watermarked? Previews always are. PDF downloads are stamped with your email, the time and the document id; other file types download as they were uploaded. #### How long are deleted files kept? 30 days in the room's trash, where they can be restored. After that they are removed and recorded in the destruction log. #### What is the largest file I can upload? 100 MB per upload request. #### Is my data used to train AI models? Documents are indexed, and assistant chats answered, through OpenRouter with provider data collection denied and zero data retention. #### Why were all my sessions ended? A token was used with a different User-Agent from the one that signed in, which looks like a stolen cookie. Sign in again, and keep one client with a fixed User-Agent per token. #### Do API tokens expire? After 24 hours, or immediately when the account is suspended or its sessions are revoked. Sign in again for a new one. #### Can I get the API spec as a file? Yes. Use **Download OpenAPI spec** at the bottom of this portal's navigation to import it into Postman, Insomnia or a code generator. ## API reference: Mesta VDR API ### Operations - `GET /health`: Liveness check ([healthCheck](https://vdr.mesta.click/developers#healthCheck)) - `GET /attestation`: TDX attestation of the platform ([getAttestation](https://vdr.mesta.click/developers#getAttestation)) ### Contact - `POST /contact`: Send a message to the Mesta team (landing page contact form) ([contact](https://vdr.mesta.click/developers#contact)) ### Auth - `POST /auth/login`: Sign in with email and password ([login](https://vdr.mesta.click/developers#login)) - `POST /auth/resend-verification`: Re-send the email verification link ([resendVerification](https://vdr.mesta.click/developers#resendVerification)) - `POST /auth/session-mismatch`: Revoke all sessions after a User-Agent mismatch ([sessionMismatch](https://vdr.mesta.click/developers#sessionMismatch)) - `POST /auth/signup`: Create an organization and its owner ([signup](https://vdr.mesta.click/developers#signup)) - `POST /auth/verify-email`: Consume an email verification link ([verifyEmail](https://vdr.mesta.click/developers#verifyEmail)) - `POST /auth/forgot-password`: Email a password reset link ([forgotPassword](https://vdr.mesta.click/developers#forgotPassword)) - `POST /auth/reset-password`: Set a new password with a reset link ([resetPassword](https://vdr.mesta.click/developers#resetPassword)) - `POST /auth/change-password`: Change the signed-in user's password ([changePassword](https://vdr.mesta.click/developers#changePassword)) - `POST /auth/wallet/challenge`: Start a Solana wallet sign-in ([walletChallenge](https://vdr.mesta.click/developers#walletChallenge)) - `POST /auth/wallet/login`: Sign in with a signed wallet challenge ([walletLogin](https://vdr.mesta.click/developers#walletLogin)) ### Users - `POST /auth/invite`: Create a user in an organization the caller administers ([inviteUser](https://vdr.mesta.click/developers#inviteUser)) - `POST /users/{id}/suspend`: Suspend a user ([suspendUser](https://vdr.mesta.click/developers#suspendUser)) - `POST /users/{id}/unsuspend`: Lift a user's suspension ([unsuspendUser](https://vdr.mesta.click/developers#unsuspendUser)) ### Profile - `GET /orgs`: List the caller's organizations ([listMyOrgs](https://vdr.mesta.click/developers#listMyOrgs)) - `GET /profile`: Get the caller's profile and organization ([getProfile](https://vdr.mesta.click/developers#getProfile)) - `PATCH /profile`: Update the caller's profile ([updateProfile](https://vdr.mesta.click/developers#updateProfile)) ### Rooms - `GET /rooms`: List data rooms visible to the caller ([listRooms](https://vdr.mesta.click/developers#listRooms)) - `POST /rooms`: Create a data room ([createRoom](https://vdr.mesta.click/developers#createRoom)) - `GET /rooms/{id}`: Get a data room ([getRoom](https://vdr.mesta.click/developers#getRoom)) - `PATCH /rooms/{id}`: Update room name, description, or status ([updateRoom](https://vdr.mesta.click/developers#updateRoom)) - `DELETE /rooms/{id}`: Delete a data room ([deleteRoom](https://vdr.mesta.click/developers#deleteRoom)) ### Folders - `GET /rooms/{id}/folders`: List folders in a room ([listFolders](https://vdr.mesta.click/developers#listFolders)) - `POST /rooms/{id}/folders`: Create a folder ([createFolder](https://vdr.mesta.click/developers#createFolder)) - `DELETE /rooms/{id}/folders/{folder_id}`: Delete a folder ([deleteFolder](https://vdr.mesta.click/developers#deleteFolder)) ### NDA - `GET /rooms/{id}/nda`: Get the room's NDA and the caller's acceptance state ([getNda](https://vdr.mesta.click/developers#getNda)) - `POST /rooms/{id}/nda`: Accept the room's NDA ([acceptNda](https://vdr.mesta.click/developers#acceptNda)) - `PUT /rooms/{id}/nda`: Set or clear the room's NDA text ([setNdaText](https://vdr.mesta.click/developers#setNdaText)) ### Documents - `GET /rooms/{id}/documents`: List a room's documents (paginated, ordered by name) ([listDocuments](https://vdr.mesta.click/developers#listDocuments)) - `DELETE /rooms/{id}/documents/{document_id}`: Delete (soft-delete to trash) a document ([deleteDocument](https://vdr.mesta.click/developers#deleteDocument)) - `GET /rooms/{id}/documents/{document_id}/download`: Download a document's bytes (PDFs watermarked with the viewer's identity) ([downloadDocument](https://vdr.mesta.click/developers#downloadDocument)) - `GET /rooms/{id}/documents/{document_id}/preview`: Render one page of a document as a watermarked PNG ([previewDocument](https://vdr.mesta.click/developers#previewDocument)) - `GET /rooms/{id}/documents/{document_id}/proof`: OpenTimestamps proof that a document existed unchanged ([documentProof](https://vdr.mesta.click/developers#documentProof)) - `POST /rooms/{id}/documents/{document_id}/rescan`: Re-queue a malware scan that errored or never completed ([rescanDocument](https://vdr.mesta.click/developers#rescanDocument)) - `POST /rooms/{id}/documents/{document_id}/restore`: Restore a document from the room's trash ([restoreDocument](https://vdr.mesta.click/developers#restoreDocument)) - `GET /rooms/{id}/documents/deleted`: List the room's trash (soft-deleted documents), newest first ([listDeletedDocuments](https://vdr.mesta.click/developers#listDeletedDocuments)) - `GET /rooms/{id}/documents/destruction-log`: List permanent-removal records (certificate-of-destruction trail), newest first ([listDestructionLog](https://vdr.mesta.click/developers#listDestructionLog)) - `POST /rooms/{id}/documents/upload`: Upload a document (multipart/form-data) ([uploadDocument](https://vdr.mesta.click/developers#uploadDocument)) ### Search - `POST /rooms/{id}/semantic-search`: Vector search over a room's indexed document chunks ([semanticSearch](https://vdr.mesta.click/developers#semanticSearch)) ### Members - `GET /rooms/{id}/members`: List room members (need-to-know filtered) ([listMembers](https://vdr.mesta.click/developers#listMembers)) - `POST /rooms/{id}/members`: Add a member (or change an existing member's level) ([addMember](https://vdr.mesta.click/developers#addMember)) - `PATCH /rooms/{id}/members/{member_user_id}`: Change a member's permission level ([updateMember](https://vdr.mesta.click/developers#updateMember)) - `DELETE /rooms/{id}/members/{member_user_id}`: Remove a member from the room ([removeMember](https://vdr.mesta.click/developers#removeMember)) ### Access proofs - `GET /rooms/{id}/access-proof`: On-chain access-proof state for the room ([getAccessProof](https://vdr.mesta.click/developers#getAccessProof)) - `POST /rooms/{id}/access-proof/key`: Register the caller's pseudonymous room key ([registerAccessKey](https://vdr.mesta.click/developers#registerAccessKey)) - `DELETE /rooms/{id}/access-proof/key`: Drop the caller's pseudonymous room key ([unregisterAccessKey](https://vdr.mesta.click/developers#unregisterAccessKey)) - `POST /rooms/{id}/access-proof/provision`: Initialize and delegate the room's on-chain account ([provisionAccessProof](https://vdr.mesta.click/developers#provisionAccessProof)) - `POST /rooms/{id}/access-proof/sync`: Re-push the member set to the on-chain permission ([resyncAccessProof](https://vdr.mesta.click/developers#resyncAccessProof)) ### Audit - `GET /audit`: List the organization's audit log ([listAudit](https://vdr.mesta.click/developers#listAudit)) - `GET /audit/verify`: Verify the organization's audit hash chains ([verifyAudit](https://vdr.mesta.click/developers#verifyAudit)) - `GET /rooms/{id}/audit`: List audit entries of one room ([roomAudit](https://vdr.mesta.click/developers#roomAudit)) - `GET /rooms/{id}/evidence`: Evidence bundle of one room ([roomEvidence](https://vdr.mesta.click/developers#roomEvidence)) ### Security - `GET /access-review`: Access recertification report ([accessReview](https://vdr.mesta.click/developers#accessReview)) - `GET /sessions`: List login sessions (IP/device log) ([listSessions](https://vdr.mesta.click/developers#listSessions)) ### Integrations - `GET /integrations/terms`: Agentic Integrations Terms & Conditions ([agenticTerms](https://vdr.mesta.click/developers#agenticTerms)) - `GET /integrations`: List agentic API keys ([listIntegrations](https://vdr.mesta.click/developers#listIntegrations)) - `POST /integrations`: Create an agentic API key ([createIntegration](https://vdr.mesta.click/developers#createIntegration)) - `DELETE /integrations/{id}`: Revoke an agentic API key ([revokeIntegration](https://vdr.mesta.click/developers#revokeIntegration)) - `GET /webhooks`: List webhook endpoints ([listWebhooks](https://vdr.mesta.click/developers#listWebhooks)) - `POST /webhooks`: Register a webhook endpoint ([createWebhook](https://vdr.mesta.click/developers#createWebhook)) - `PATCH /webhooks/{id}`: Pause, resume or re-filter a webhook ([updateWebhook](https://vdr.mesta.click/developers#updateWebhook)) - `DELETE /webhooks/{id}`: Delete a webhook endpoint ([deleteWebhook](https://vdr.mesta.click/developers#deleteWebhook)) - `POST /webhooks/{id}/test`: Queue a test delivery ([testWebhook](https://vdr.mesta.click/developers#testWebhook)) - `GET /webhooks/{id}/deliveries`: Recent deliveries of a webhook ([listWebhookDeliveries](https://vdr.mesta.click/developers#listWebhookDeliveries)) ### Billing - `GET /billing/plans`: List price tiers ([listPlans](https://vdr.mesta.click/developers#listPlans)) - `GET /billing/orgs/{org_id}`: Plan, period, usage and credits of an organization ([getBillingAccount](https://vdr.mesta.click/developers#getBillingAccount)) - `GET /billing/orgs/{org_id}/quote`: Price of a plan now ([getBillingQuote](https://vdr.mesta.click/developers#getBillingQuote)) - `POST /billing/orgs/{org_id}/subscription`: Buy, renew or change the plan (MPP) ([buyPlan](https://vdr.mesta.click/developers#buyPlan)) - `GET /billing/orgs/{org_id}/payments`: Payment ledger ([listBillingPayments](https://vdr.mesta.click/developers#listBillingPayments)) - `GET /billing/solana-subscriptions`: On-chain plans for USDC subscriptions ([getSolanaSubscriptionPlans](https://vdr.mesta.click/developers#getSolanaSubscriptionPlans)) - `POST /billing/orgs/{org_id}/solana-subscription/transaction`: Unsigned subscribe transaction for the admin's wallet ([prepareSolanaSubscription](https://vdr.mesta.click/developers#prepareSolanaSubscription)) - `POST /billing/orgs/{org_id}/solana-subscription`: Start a plan paid by a USDC subscription ([startSolanaSubscription](https://vdr.mesta.click/developers#startSolanaSubscription)) - `POST /billing/orgs/{org_id}/solana-pay`: Solana Pay request for a plan ([createSolanaPayRequest](https://vdr.mesta.click/developers#createSolanaPayRequest)) - `GET /billing/orgs/{org_id}/solana-pay/{reference}`: Status of a Solana Pay request ([getSolanaPayRequest](https://vdr.mesta.click/developers#getSolanaPayRequest)) - `POST /billing/orgs/{org_id}/solana-delegation/transaction`: Spend-permit the server delegate ([buildSolanaDelegation](https://vdr.mesta.click/developers#buildSolanaDelegation))