Reason is built as three public architecture layers — Core, Timeline, and Brain — each with a job your contracts team can understand. The partner API exposes a read-only surface scoped to your token's org.
Reason is not a single product. It is three platforms working together on your org's data. Naming them here is a load-bearing promise to your team and to procurement reviewers: every capability you buy is grounded in one of these layers.
Every Reason capability runs on it. Core is the score-and-signal substrate: it stores opportunity context, your company profile, and the historical performance record that every analysis pulls against.
services/pwin.js against Core query resultsorganization_idThe decision engine that turns your company history into better bids and better win predictions. Brain reads from Core, reasons over your org's memory, and returns graded, explainable recommendations.
services/proposal-ai.js through Brainservices/onboarding-ai.js is a Brain capabilityThe chronological layer that turns Brain's decisions into history you can replay. Every opportunity analyzed, every proposal submitted, every award, every loss, every lesson learned — captured once, retrievable forever.
capture_gates — planned vs. actual gate decisionswin_loss_records with debrief and lessons-learned fieldscapture_amendments with impact assessmentThese are the connectors live in production today, plus the read-only API surface we expose for partner integrations. We do not advertise connectors we don't have — if it's not in this list, it isn't shipping.
Each org configures its own API key in organization_sam_settings. We call SAM.gov on your behalf, upsert by sam_solicitation_id, and never transmit your key to a third party.
polsia.tomlsam_solicitation_id; idempotent sync logEvery PWIN run returns a 0-100 score, a confidence interval, and the per-signal decomposition that explains what moved the number. The same shape is available via the partner API for an org's read-only caller.
agency_history 0.71, competition_density 0.42, set_aside_fit 0.88 → PWIN 64 ± 7.Drafts are generated inside services/proposal-ai.js from your org's stored past performance, key personnel bios, and the active solicitation context. No cross-org training, no shared model memory between tenants.
docx npm packageReason speaks to the Polsia AI Proxy via the ANTHROPIC_BASE_URL environment variable — an OpenAI/Anthropic-compatible surface wired at the platform level. No direct provider keys live in this app's source.
All paid plans go through Stripe Checkout — we never touch card data. We persist order IDs, subscription IDs, and billing status only. Card data lives in Stripe's vault under PCI DSS Level 1.
routes/checkout.js creates sessions; success verifies server-sidePOST /webhook/stripe with raw-body signature verificationA bearer token your team or a partner can mint for an org grants read-only access to that org's scored opportunities and PWIN signal breakdowns. Tokens are revocable from team-settings and audit-logged.
Every endpoint below requires an Authorization: Bearer <partner_token> header. Tokens are org-scoped and rate-limited per token; see the FAQ below for limits and rotation.
# Probe that a partner token is valid and confirm its org scope. GET /api/integrations/v1/health Authorization: Bearer <partner_token> # 200 OK { "org": "org_3f7b…", "scopes": ["integrations.read"], "issued_at": "2026-07-15T18:24:00Z", "partner_token": true } # List the org's scored opportunities (read-only). GET /api/integrations/v1/opportunities?limit=50 Authorization: Bearer <partner_token> { "opportunities": [ { "id": "opp_92a1", "pwin": 64, "ci": "±7" } ] }
planned: true in the manifest.
Reason's partner surface is read-only and scoped to a single org. Talk to us about a token for your capture team's tools, an agency reviewer account, or a partner-network integration — we will scope and ship it together.
Talk to IntegrationsWhat we will ask: your use case, the data you want exposed (always read-only), and the org that will own the token. What you get back: a token scoped to your org with a 90-day rotation reminder and a documented endpoint list.
Not yet — it's on the roadmap. Today we expose a read-only HTTP API at /api/integrations. If MCP becomes a procurement requirement for a federal partner, we'll add it; we'd rather under-claim than enumerate connectors we don't ship.
60 requests per minute per token, burstable to 120 for short windows. We return 429 Retry-After on overage. Enterprise partners who need higher quotas get them scoped in the partner agreement, not in the public manifest.
Org owners can revoke any active partner token from team-settings as soon as that flow ships (Q4 2026 release). Until then, rotation is handled by integrations@reasongov.com on request. Every token mint and revocation is written to the application event log.
No. The v1 surface is read-only by design. There are no write endpoints, no admin endpoints, and no way to impersonate a user. If a write path becomes available in v2, it will require a separate scope and an explicit opt-in in team-settings.
No. Read-only API responses flow to your tooling; they do not feed Reason model training. The same data-handling rules that apply to the Reason UI apply to anything returned through the partner API. See /security for the full statement.
PWIN signal breakdowns do not contain personally identifiable information. They expose scored opportunity metadata and aggregate signals appropriate for partner consumption. If a particular signal stream needs CUI handling, we'll scope a dedicated deployment — same posture as /security.