v0.1.66: Verified — 65+ Inbound BFF API Routes Are Missing

What Was Found

As part of the ongoing verification pass on the rebuilt myProp platform, release v0.1.66 confirms a significant gap: 65+ inbound REST API routes that were present in the original Lambda BFF specification are not implemented in the current application.

If your agency's integrations, AgentOS webhooks, or any external system makes direct HTTP calls to routes like POST /company/verify, POST /accounts, or POST /messaging/messages, those requests are currently returning 404 Not Found.

Background: What Is the BFF Layer?

The Backend-for-Frontend (BFF) layer is a thin API surface that sits between external callers and the core platform. In the original architecture, these routes were handled by dedicated Lambda functions and served as the canonical entry points for:

Account operations — creating accounts, handling payment requests
Company verification — validating company identity and details
Messaging — posting messages between parties
Overrides — applying configuration or data overrides
And 60+ additional resource operations

In the rebuilt app, this layer has not yet been re-implemented. The app exposes tRPC at /api/trpc/* for internal UI use, and a general-purpose REST handler at /api/v1/rest/[...path] — but neither of these covers the original BFF route surface.

Who Is Affected?

Caller Type	Affected?
myProp portal UI (tRPC)	✅ Not affected
AgentOS webhooks to original REST paths	⚠️ Affected — will 404
Third-party integrations using original paths	⚠️ Affected — will 404
Internal SaaS Factory shell consumers	✅ Not affected

What Needs to Be Done

The recommended remediation is to add Next.js App Router route handlers for each missing path. Each handler should map the inbound POST body to the equivalent tRPC procedure or letmcClient call.

Example Implementation

// app/api/company/verify/route.ts
import { NextRequest, NextResponse } from 'next/server';
import { letmcClient } from '@/lib/letmcClient';

export async function POST(req: NextRequest) {
  const body = await req.json();
  const result = await letmcClient.company.verify(body);
  return NextResponse.json(result);
}

// app/api/accounts/route.ts
import { NextRequest, NextResponse } from 'next/server';
import { letmcClient } from '@/lib/letmcClient';

export async function POST(req: NextRequest) {
  const body = await req.json();
  const result = await letmcClient.accounts.create(body);
  return NextResponse.json(result);
}

// app/api/accounts/payment-requests/route.ts
import { NextRequest, NextResponse } from 'next/server';
import { letmcClient } from '@/lib/letmcClient';

export async function POST(req: NextRequest) {
  const body = await req.json();
  const result = await letmcClient.accounts.createPaymentRequest(body);
  return NextResponse.json(result);
}

// app/api/messaging/messages/route.ts
import { NextRequest, NextResponse } from 'next/server';
import { letmcClient } from '@/lib/letmcClient';

export async function POST(req: NextRequest) {
  const body = await req.json();
  const result = await letmcClient.messaging.sendMessage(body);
  return NextResponse.json(result);
}

Affected Route Groups

Based on the original specification, the missing routes span the following resource groups:

/company/* — Company verification and settings
/accounts/* — Account creation and payment requests
/messaging/* — Message dispatch
/overrides/* — Data and config overrides
(+ ~60 additional routes across other resource domains)

Current API Surface (Unchanged)

This release makes no code changes. The existing API surfaces remain:

POST /api/trpc/*           — tRPC procedures (internal portal UI)
GET|POST /api/v1/rest/[...path] — SaaS Factory shell REST handler

Next Steps

This finding is tracked for resolution. The implementation work involves:

Enumerating all 65+ routes from the original specification.
Creating corresponding Next.js route handler files under app/api/.
Mapping each route to its tRPC procedure or letmcClient equivalent.
Adding integration tests to verify each endpoint returns the expected response shape.

Until these routes are implemented, agencies should avoid pointing external integrations at the original BFF paths, or proxy traffic through the /api/v1/rest/[...path] handler where compatible.