[High] PATCH /automations/{id}/steps/{step_id} returns 404 — campaign email content is read-only via public API

[loic2309]

Summary

Automation steps (email subject, body, delay configuration) can be read via the public API but cannot be modified. PATCH on any step endpoint returns 404.

Steps to Reproduce

# GET works — returns full step content including email subject and body
curl -H "Authorization: $OVERLOOP_API_KEY" \
  "https://api.overloop.ai/public/v1/automations/7406/steps/62f8904a-c202-4133-8f0a-33ce0fe3909c"
# Response: 200 — full step attributes including config.subject and config.content

# PATCH fails
curl -X PATCH \
  -H "Authorization: $OVERLOOP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"config": {"subject": "Updated subject"}}' \
  "https://api.overloop.ai/public/v1/automations/7406/steps/62f8904a-c202-4133-8f0a-33ce0fe3909c"
# Response: 404 HTML

Tested Combinations

Method	Endpoint	Content-Type	Result
GET	/automations/{id}/steps/{step_id}	—	200 ✅
PATCH	/automations/{id}/steps/{step_id}	application/json	404 ❌
PATCH	/automations/{id}/steps/{step_id}	application/vnd.api+json	404 ❌
PUT	/automations/{id}/steps/{step_id}	application/json	404 ❌
PATCH	/automations/{id} (campaign itself)	application/json	404 ❌

Expected Behavior

PATCH /automations/{id}/steps/{step_id} should allow updating config.subject, config.content, and config.offset (for delay steps).

Actual Behavior

All write operations on steps and campaigns return 404 HTML. Read-only.

Impact

Full campaign management (editing email copy, adjusting delays, updating subject lines) requires the Overloop UI. It is not possible to build an automated campaign management workflow or use an AI agent to iterate on email content programmatically.