Patrick Bass Area: Integration / API (audit p13) · Surface: mobieusAPI / mobieusCore · Dimension: competitor-gap · Severity: major
Circle and Discourse both expose write APIs for the heart of the product: Discourse's API can create topics, posts, users, private messages and upload files; Circle's API/headless offering and Skool's automations let you create members and post programmatically. Mobieus exposes 14 read-only community GETs plus full CRUD for the two suite products, but you cannot programmatically post into a forum, open a DM, or onboard a user into the community itself. This blocks the most common integration jobs customers ask for: cross-posting from a CMS/newsletter into the community, syncing an external CRM's contacts as members, and bot-posting from automations. The asymmetry (Help/Learn writable, Community not) is the opposite of what a community-first brand wants.
Evidence
platform/src/routes.php:175-179 registers ONLY GET for community core: `$router->get('/events'...)`, `$router->get('/users'...)`, `$router->get('/users/{id}'...)`, `$router->get('/posts'...)`, `$router->get('/posts/{id}'...)`. Confirmed `grep -E "post\('/api/v1/(posts|users|threads|listings|files|events|moderation)" src/routes.php` returns nothing. Helpdesk/Learn/Know got full CRUD (HelpdeskController@createTicket, LearnController@coursesCreate, KnowledgeApiController@pagesCreate) but the flagship community plane cannot create a thread, post a reply, send a DM, or create/update a user via API.Suggested fix. Add scoped write endpoints to the community core: POST /api/v1/threads, POST /api/v1/threads/{id}/posts, POST /api/v1/users (invite/create), POST /api/v1/messenger (start DM), gated by new posts:write / users:write scopes. Reuse the existing ForumController/AccountController service paths so moderation, rate limits, and notifications still fire.
Filed by the automated tenant-app audit and adversarially evidence-verified. Status: verified. Open — not yet actioned.
Patrick Bass
@mobieus
