Are /api/onboarding/research and extract-content still needed? Both appear unused, as account-status was

[SEPURI-SAI-KRISHNA]

#1589 removed /api/onboarding/account-status as unused. Its two remaining siblings look to be in the same state, and I wanted to check before assuming.

What I can see

Neither route has a caller anywhere in the repo. Searching current main:

• extract-content: one hit, its own route file (the EXA_API_KEY warning string)
• onboarding/research: zero hits
• ExaContentResult is exported from the extract-content route but imported nowhere

Both were added in #672 (Jan 2026) and last changed functionally in #994 (Jun 2026). Everything after that is hardening rather than use.

Why removal might be preferable to maintaining them

Each request spends metered third-party quota:

• extract-content calls Exa with livecrawl: "fallback"
• research calls xAI grok-4-fast with the web_search and x_search tools

#1589 added session verification, which closes the unauthenticated case. What remains is that any authenticated user can call both freely, with no rate limit, against endpoints nothing in the product appears to use. Deleting them drops ~246 lines and two billable surfaces, rather than carrying bounds on code with no callers.

The question

Is either route being kept deliberately, for an onboarding flow that isn't wired up yet or a caller outside this repository? I can only see this repo, so I can't rule that out, which is why this is an issue rather than a PR.

If they are dead, I'm happy to open the deletion PR. apps/web/lib/verify-session.ts would stay as-is, since /api/og uses it too.

For context, I opened #1528 and #1530 to bound these two routes; both were closed in favour of #1589.

[linear-code]

ENG-1216

[addyCooks]

Good news this one's already handled. #1596 landed both deletions the day after you opened this.

Receipts, checked against main @ 3f7b966:

• research/route.ts and extract-content/route.ts → both gone
• git grep "api/onboarding" across the whole repo → zero hits, so nothing was left pointing at them
• apps/web/lib/verify-session.ts → untouched and still there, with apps/web/app/api/og/route.ts as its only consumer

You called that last one exactly right, and the ~246 was exact too: 114 + 132 post-#1589. #1596 reads as 262 deletions because it also picked up a console.log fix from #1473 plus the config cleanup.

It went a step past what you scoped, in the same direction you were already pointing:

• EXA_API_KEY and XAI_API_KEY out of apps/web/.env.example
• @ai-sdk/xai out of apps/web/package.json nothing depended on it once the routes went. It still shows up in bun.lock transitively via @voltagent/core, which is expected, not a leftover.

On the PR offer: @ishaanxgupta had already opened #1563 doing exactly this, and it got cherry-picked into #1596 so there's nothing left to build here.

Also worth saying, #1528 and #1530 didn't go to waste. They're what surfaced these as metered and unauthenticated in the first place, #1589 closed the auth gap repo-wide, and #1596 removed the surfaces entirely once this issue got the "is it actually dead" answer. Asking here instead of sending the PR blind was the right call.

Safe to close.