API Reference

BidStacker's REST API for programmatic access to RFPs, proposals, templates, and AI features.

Authentication

Every endpoint accepts a Supabase session cookie (when calling from the web app). Endpoints marked Cookie or Bearer PAT additionally accept a scoped Personal Access Token for server-to-server, MCP, and CLI access: create a PAT under Settings → Integrations and send it in the Authorization: Bearer header. PATs are tenant-isolated and respect row-level security — never use a Supabase service-role key.

curl "https://www.bidstacker.xyz/api/proposals?status=draft&limit=5" \
  -H "Authorization: Bearer pat_YOUR_PERSONAL_ACCESS_TOKEN"

# 200 OK
{
  "proposals": [
    {
      "id": "1f0c9b2e-8a41-4f3d-9c27-5b1e6d8a0c42",
      "title": "Proposal: IT Support Services — Dept. of Energy",
      "status": "draft",
      "organization_id": "7a52e9d1-03bc-48f6-b210-9e4f7c1d5a88",
      "rfp_id": "c3d41b76-2e9f-4a05-8d13-f6a07b92c001",
      "collaboration_mode": "solo",
      "is_joint": false,
      "created_at": "2026-06-10T18:22:31.000Z",
      "updated_at": "2026-06-11T09:14:02.000Z"
    }
  ]
}

Base URL: https://www.bidstacker.xyz

smart_toy

Looking for AI agent integration?

The MCP server provides 29 tools for Claude Code, Claude Desktop, and other AI agents.

MCP Docsarrow_forward

GET/api/rfps

Search and filter RFPs

Auth: Cookie (Supabase session)

Parameters

keywordstring— Full-text search across title, description, agency

limitnumber— Max results (default: 50)

POST/api/rfps

Trigger an RFP sync from SAM.gov

Auth: Cookie (Supabase session)

Parameters

keywordstring— Search keyword for SAM.gov

limitnumber— Max results to fetch

GET/api/saved-rfps

List bookmarked RFPs for the authenticated user

Auth: Cookie (Supabase session)

POST/api/saved-rfps

Bookmark an RFP

Auth: Cookie (Supabase session)

Parameters

rfpIdstring (UUID)— RFP to bookmark

DELETE/api/saved-rfps

Remove an RFP bookmark

Auth: Cookie (Supabase session)

Parameters

rfpIdstring (UUID)— RFP to unbookmark

GET/api/notifications

List notifications for authenticated user

Auth: Cookie (Supabase session)

PUT/api/notifications

Mark notifications as read

Auth: Cookie (Supabase session)

Parameters

idsstring[] (UUIDs)— Notification IDs to mark read

GET/api/proposals

List the proposals visible to the caller

Auth: Cookie or Bearer PAT

Parameters

statusenum— draft | review | submitted | awarded | lost

rfp_idstring (UUID)— Only proposals linked to this RFP

limitnumber— Max results (1-200, default: 200)

offsetnumber— Pagination offset (default: 0)

GET/api/proposals/[id]

Get one proposal including its content sections

Auth: Cookie or Bearer PAT

GET/api/proposals/[id]/compliance

Run compliance checks on a proposal and return the scored results

Auth: Cookie or Bearer PAT

GET/api/organization

Get the caller's organization profile

Auth: Cookie or Bearer PAT

PUT/api/proposals/[id]/status

Change proposal status with transition validation

Auth: Cookie (Supabase session)

Parameters

statusenum— draft | review | submitted | awarded | lost

POST/api/proposals/generate-draft

Generate AI content for a proposal section

Auth: Cookie or Bearer PAT + Rate limit (10/min)

Parameters

rfpIdstring (UUID)— Target RFP

sectionTitlestring— Section to generate

proposalIdstring (UUID, optional)— Existing proposal — injects its uploaded documents as grounding context

toneenum— formal | technical | persuasive

POST/api/ai

AI text processing (improve, shorten, expand, etc.)

Auth: Cookie (Supabase session) + Rate limit

Parameters

actionenum— professional | shorten | expand | summarize | custom

contentstring— Text to process

GET/api/templates

List proposal templates (default + organization)

Auth: Cookie (Supabase session)

POST/api/templates

Create a new proposal template

Auth: Cookie (Supabase session)

Parameters

namestring— Template name

sectionsarray— Section definitions [{title, body?}]

GET/api/sync/status

Get recent sync run history

Auth: Cookie (Supabase session)

POST/api/sync/trigger

Manually trigger a data sync

Auth: Cookie (Supabase session) + Rate limit (3/min)

Parameters

sourceenum— federal | state

daysBacknumber— Days to look back (1-7)

POST/api/matching-framework/generate

Generate AI matching framework from org profile

Auth: Cookie (Supabase session)

POST/api/contact

Submit a contact form message

Auth: Public (rate limited by IP)

Parameters

namestring— Sender name

emailstring— Sender email

subjectstring— Message subject

messagestring— Message body

Authentication

curl "https://www.bidstacker.xyz/api/proposals?status=draft&limit=5" \
  -H "Authorization: Bearer pat_YOUR_PERSONAL_ACCESS_TOKEN"

# 200 OK
{
  "proposals": [
    {
      "id": "1f0c9b2e-8a41-4f3d-9c27-5b1e6d8a0c42",
      "title": "Proposal: IT Support Services — Dept. of Energy",
      "status": "draft",
      "organization_id": "7a52e9d1-03bc-48f6-b210-9e4f7c1d5a88",
      "rfp_id": "c3d41b76-2e9f-4a05-8d13-f6a07b92c001",
      "collaboration_mode": "solo",
      "is_joint": false,
      "created_at": "2026-06-10T18:22:31.000Z",
      "updated_at": "2026-06-11T09:14:02.000Z"
    }
  ]
}

Base URL: https://www.bidstacker.xyz