API Authentication and Conventions

This page explains the fields in the generated endpoint catalog. For the platform-wide request path, bearer-token convention, error envelope, and retry guidance, see API.

Source-derived is not deployed. Every route below was found in service source code. That does not mean it is deployed, reachable from outside the platform, publicly supported, or that its declared authentication is enforced in any particular deployment.

Auth status

Auth status is derived from source and is deliberately conservative. It records what a reader can see declared, not what a deployment enforces.

Value	Meaning
EXPLICIT	The route handler itself declares an auth-related dependency (for example a permission check).
INHERITED	The route sits under a router or application that declares an auth-related dependency.
INDIRECT	No dependency is declared on the route, but auth-related logic is visible elsewhere: an authentication middleware registered on the application, or an auth-related call inside the handler. Middleware may exempt specific paths; that is not analysed beyond what a route's note says.
UNKNOWN	No auth evidence is visible in the route's own source. This is not the same as unauthenticated. Authentication can be applied by a gateway or proxy, by middleware, by in-handler checks this catalog does not recognise, or by upstream delegation.

Auth evidence entries name the declared dependency or call. They are matched by name pattern, so they show that auth-related logic is declared -- they do not prove it is correct or effective.

Paths

A route can have several distinct paths, and the catalog never merges them:

Field	Meaning
declared_path	The path written on the route decorator, as it appears in source.
effective_source_path	The path after applying the router and include_router prefixes found in source. This is the service-local path.
service_root_path	Whether the application declares a reverse-proxy root path. The value is an internal mount prefix and is not published.
gateway_path	Populated only when the API gateway's own routing table maps the service and its catch-all handler proxies the route's HTTP method. Otherwise UNKNOWN.
external_path	Populated only when an existing platform document states the path. Otherwise UNKNOWN.

A service-local path must not be assumed to be an externally reachable URL. Some services are reachable through the gateway, some through other reverse-proxy routes, and for several the mapping is not proven from source.

Visibility

Only routes classified PUBLIC or AUTHENTICATED_PUBLIC are itemised. PUBLIC means eligible for the public documentation build (it does not mean "no authentication"); AUTHENTICATED_PUBLIC additionally requires visible auth evidence. Anything the manifest does not classify defaults to REVIEW_REQUIRED and is counted only.

Verification state

Every entry is IMPLEMENTED_IN_SOURCE: a route handler was found in source. No entry is claimed to be deployed, tested, or operationally verified. Source links point at the exact source revision the entry was generated from; the platform has no repository-wide stable-link policy, so a link is only as durable as that revision.