API Reference

BidStacker's REST API for programmatic access to RFPs, proposals, templates, and AI features.

Authentication

Every endpoint accepts a Supabase session cookie (when calling from the web app). Endpoints marked Cookie or Bearer PAT additionally accept a scoped Personal Access Token for server-to-server, MCP, and CLI access: create a PAT under Settings → Integrations and send it in the Authorization: Bearer header. PATs are tenant-isolated and respect row-level security — never use a Supabase service-role key.

curl "https://www.bidstacker.xyz/api/proposals?status=draft&limit=5" \
  -H "Authorization: Bearer pat_YOUR_PERSONAL_ACCESS_TOKEN"

# 200 OK
{
  "proposals": [
    {
      "id": "1f0c9b2e-8a41-4f3d-9c27-5b1e6d8a0c42",
      "title": "Proposal: IT Support Services — Dept. of Energy",
      "status": "draft",
      "organization_id": "7a52e9d1-03bc-48f6-b210-9e4f7c1d5a88",
      "rfp_id": "c3d41b76-2e9f-4a05-8d13-f6a07b92c001",
      "collaboration_mode": "solo",
      "is_joint": false,
      "created_at": "2026-06-10T18:22:31.000Z",
      "updated_at": "2026-06-11T09:14:02.000Z"
    }
  ]
}
Base URL: https://www.bidstacker.xyz

Looking for AI agent integration?

The MCP server provides 29 tools for Claude Code, Claude Desktop, and other AI agents.

MCP Docsarrow_forward
GET/api/rfps

Search and filter RFPs

Auth: Cookie (Supabase session)

Parameters
keywordstring— Full-text search across title, description, agency
limitnumber— Max results (default: 50)
POST/api/rfps

Trigger an RFP sync from SAM.gov

Auth: Cookie (Supabase session)

Parameters
keywordstring— Search keyword for SAM.gov
limitnumber— Max results to fetch
GET/api/saved-rfps

List bookmarked RFPs for the authenticated user

Auth: Cookie (Supabase session)

POST/api/saved-rfps

Bookmark an RFP

Auth: Cookie (Supabase session)

Parameters
rfpIdstring (UUID)— RFP to bookmark
DELETE/api/saved-rfps

Remove an RFP bookmark

Auth: Cookie (Supabase session)

Parameters
rfpIdstring (UUID)— RFP to unbookmark
GET/api/notifications

List notifications for authenticated user

Auth: Cookie (Supabase session)

PUT/api/notifications

Mark notifications as read

Auth: Cookie (Supabase session)

Parameters
idsstring[] (UUIDs)— Notification IDs to mark read
GET/api/proposals

List the proposals visible to the caller

Auth: Cookie or Bearer PAT

Parameters
statusenum— draft | review | submitted | awarded | lost
rfp_idstring (UUID)— Only proposals linked to this RFP
limitnumber— Max results (1-200, default: 200)
offsetnumber— Pagination offset (default: 0)
GET/api/proposals/[id]

Get one proposal including its content sections

Auth: Cookie or Bearer PAT

GET/api/proposals/[id]/compliance

Run compliance checks on a proposal and return the scored results

Auth: Cookie or Bearer PAT

GET/api/organization

Get the caller's organization profile

Auth: Cookie or Bearer PAT

PUT/api/proposals/[id]/status

Change proposal status with transition validation

Auth: Cookie (Supabase session)

Parameters
statusenum— draft | review | submitted | awarded | lost
POST/api/proposals/generate-draft

Generate AI content for a proposal section

Auth: Cookie or Bearer PAT + Rate limit (10/min)

Parameters
rfpIdstring (UUID)— Target RFP
sectionTitlestring— Section to generate
proposalIdstring (UUID, optional)— Existing proposal — injects its uploaded documents as grounding context
toneenum— formal | technical | persuasive
POST/api/ai

AI text processing (improve, shorten, expand, etc.)

Auth: Cookie (Supabase session) + Rate limit

Parameters
actionenum— professional | shorten | expand | summarize | custom
contentstring— Text to process
GET/api/templates

List proposal templates (default + organization)

Auth: Cookie (Supabase session)

POST/api/templates

Create a new proposal template

Auth: Cookie (Supabase session)

Parameters
namestring— Template name
sectionsarray— Section definitions [{title, body?}]
GET/api/sync/status

Get recent sync run history

Auth: Cookie (Supabase session)

POST/api/sync/trigger

Manually trigger a data sync

Auth: Cookie (Supabase session) + Rate limit (3/min)

Parameters
sourceenum— federal | state
daysBacknumber— Days to look back (1-7)
POST/api/matching-framework/generate

Generate AI matching framework from org profile

Auth: Cookie (Supabase session)

POST/api/contact

Submit a contact form message

Auth: Public (rate limited by IP)

Parameters
namestring— Sender name
emailstring— Sender email
subjectstring— Message subject
messagestring— Message body