Web
API
01
¶ REST over httpOnly cookie JWT
Owner
apps/web/lib/api.ts
Architecture contract
¶ Transport Rules
There are four transports between ReplyBox components. Each one has a single mechanism and a single owning module; new traffic extends one of these paths instead of opening another.
Four transports
No fifth path
API
Connector
02
¶ BullMQ jobs on Redis
Owner
apps/api/app/queue/producer.py
Connector
API
03
¶ HMAC-signed HTTP POST
Owner
apps/api/app/security/hmac.py
apps/baileys-connector/src/internal/api-client.ts
API
Web
04
¶ Socket.IO rooms per org
Owner
apps/api/app/realtime/sio.py
apps/api/app/realtime/emit.py
Hard rule
¶ Do not add a fifth path
Extend the existing transport instead. When a component needs to say something new, it says it over the path it already owns.
Redis pub/subExtend the transport that already covers the direction
Websocket side-channelsSocket.IO org rooms already carry API to Web
Connector direct DB writesThe connector talks to the API over HMAC-signed HTTP