16 KiB
16 KiB
title, created, updated, status
| title | created | updated | status |
|---|---|---|---|
| Authorization matrix v3 — full route inventory | 2026-09-16 | 2026-09-16 | done |
Authorization matrix v3 — full route inventory
Generated from mux.HandleFunc registrations under internal/server/.
AuthN column is heuristic; negative-test pointers filled where known.
| Method | Path | Handler | File | AuthN (heuristic) | Neg test |
|---|---|---|---|---|---|
| GET | / |
s.serveSPA |
server.go |
handler | see suite |
| GET | /api/v1/admin/config |
s.handleAdminConfig |
server.go |
admin+project? | see suite |
| PUT | /api/v1/admin/config |
s.handleAdminConfig |
server.go |
admin+project? | see suite |
| GET | /api/v1/admin/permissions |
s.handleAdminPermissions |
server.go |
admin+project? | see suite |
| GET | /api/v1/admin/roles |
s.handleAdminRoles |
server.go |
admin+project? | see suite |
| POST | /api/v1/admin/roles |
s.handleAdminRoles |
server.go |
admin+project? | see suite |
| DELETE | /api/v1/admin/roles/{id} |
s.handleAdminRoleByID |
server.go |
admin+project? | see suite |
| PATCH | /api/v1/admin/roles/{id} |
s.handleAdminRoleByID |
server.go |
admin+project? | see suite |
| GET | /api/v1/admin/templates |
s.handleAdminTemplates |
server.go |
admin+project? | see suite |
| POST | /api/v1/admin/templates |
s.handleAdminTemplates |
server.go |
admin+project? | see suite |
| GET | /api/v1/admin/templates/{key}/versions |
s.handleAdminTemplateVersions |
server.go |
admin+project? | see suite |
| GET | /api/v1/admin/users |
s.handleAdminUsers |
server.go |
admin+project? | see suite |
| POST | /api/v1/admin/users |
s.handleAdminUsers |
server.go |
admin+project? | see suite |
| PUT | /api/v1/admin/users/{id}/role |
s.handleAdminUpdateRole |
server.go |
admin+project? | see suite |
| PUT | /api/v1/admin/users/{id}/status |
s.handleAdminUpdateStatus |
server.go |
admin+project? | see suite |
| GET | /api/v1/admin/workflows |
s.handleAdminWorkflows |
server.go |
admin+project? | see suite |
| POST | /api/v1/admin/workflows |
s.handleAdminWorkflows |
server.go |
admin+project? | see suite |
| GET | /api/v1/admin/workflows/{id} |
s.handleAdminWorkflowByID |
server.go |
admin+project? | see suite |
| PATCH | /api/v1/admin/workflows/{id}/versions/{version} |
s.handleAdminWorkflowVersion |
server.go |
admin+project? | see suite |
| POST | /api/v1/admin/workflows/{id}/versions/{version}/publish |
s.handleAdminWorkflowPublish |
server.go |
admin+project? | see suite |
| POST | /api/v1/admin/workflows/{id}/versions/{version}/retire |
s.handleAdminWorkflowRetire |
server.go |
admin+project? | see suite |
| POST | /api/v1/admin/workflows/{id}/versions/{version}/validate |
s.handleAdminWorkflowValidate |
server.go |
admin+project? | see suite |
| POST | /api/v1/admin/workspaces/reconcile |
s.handleReconcileWorkspace |
server.go |
admin+project? | see suite |
| POST | /api/v1/auth/change-password |
s.handleAuthChangePassword |
server.go |
handler | see suite |
| POST | /api/v1/auth/login |
s.handleAuthLogin |
server.go |
handler | see suite |
| POST | /api/v1/auth/logout |
s.handleAuthLogout |
server.go |
handler | see suite |
| GET | /api/v1/auth/me |
s.handleAuthMe |
server.go |
handler | see suite |
| GET | /api/v1/auth/public-config |
s.handleAuthPublicConfig |
server.go |
handler | see suite |
| POST | /api/v1/auth/register |
s.handleAuthRegister |
server.go |
handler | see suite |
| GET | /api/v1/auth/sessions |
s.handleAuthSessions |
server.go |
handler | see suite |
| DELETE | /api/v1/auth/sessions/{id} |
s.handleAuthSessionByID |
server.go |
handler | see suite |
| POST | /api/v1/chat |
s.handleChat |
server.go |
session+project (ERR_NO_PROJECT if unbound + zero memberships) | see suite |
| GET | /api/v1/chat/categories |
s.handleListChatCategories |
server.go |
session+project | see suite |
| GET | /api/v1/chat/dates |
s.handleListChatDates |
server.go |
session+project | see suite |
| GET | /api/v1/chat/digests |
s.handleListDailyDigests |
server.go |
session+project | see suite |
| POST | /api/v1/chat/digests/generate |
s.handleGenerateDailyDigest |
server.go |
session+project | see suite |
| GET | /api/v1/chat/export/messages |
s.handleChatExportMessages |
server.go |
session+project | see suite |
| GET | /api/v1/chat/messages |
s.handleGetChatMessages |
server.go |
session+project | see suite |
| GET | /api/v1/chat/messages/day |
s.handleGetChatDayMessages |
server.go |
session+project | see suite |
| POST | /api/v1/chat/messages/import |
s.handleImportChatMessages |
server.go |
session+project | see suite |
| GET | /api/v1/chat/messages/window |
s.handleGetChatWindow |
server.go |
session+project | see suite |
| GET | /api/v1/chat/messages/{message_id}/export-capability |
s.handleGetExportCapability |
server.go |
session+project | see suite |
| GET | /api/v1/chat/messages/{message_id}/export-source |
s.handleGetExportSource |
server.go |
session+project | see suite |
| POST | /api/v1/chat/read |
s.handleChatRead |
server.go |
session+project | see suite |
| POST | /api/v1/chat/recategorize |
s.handleChatRecategorize |
server.go |
session+project | see suite |
| GET | /api/v1/chat/search |
s.handleChatSearch |
server.go |
session+project | see suite |
| GET | /api/v1/chat/sessions |
s.handleListChatSessions |
server.go |
session+project | see suite |
| POST | /api/v1/chat/sessions |
s.handleUpsertChatSession |
server.go |
session+project | see suite |
| GET | /api/v1/chat/stream |
s.handleChatStream |
server.go |
session+project (ERR_NO_PROJECT if unbound + zero memberships) | see suite |
| POST | /api/v1/chat/stream |
s.handleChatStream |
server.go |
session+project (ERR_NO_PROJECT if unbound + zero memberships) | see suite |
| GET | /api/v1/chat/turns/{client_turn_id} |
s.handleGetChatTurn |
server.go |
session+project | see suite |
| GET | /api/v1/chat/unread |
s.handleChatUnread |
server.go |
session+project | see suite |
| GET | /api/v1/context/cases/recommend |
s.handleRecommendCases |
server.go |
handler | see suite |
| GET | /api/v1/context/project |
s.handleGetProjectContext |
server.go |
handler | see suite |
| GET | /api/v1/context/user |
s.handleGetUserContext |
server.go |
handler | see suite |
| PUT | /api/v1/context/user/preference |
s.handleUpdateUserPreference |
server.go |
handler | see suite |
| POST | /api/v1/docgov/approver-decision |
s.handleDocGovApproverDecision |
server.go |
handler | see suite |
| GET | /api/v1/docgov/audit-logs |
s.handleDocGovListAuditLogs |
server.go |
handler | see suite |
| POST | /api/v1/docgov/claim |
s.handleDocGovClaim |
server.go |
handler | see suite |
| GET | /api/v1/docgov/comments |
s.handleDocGovListComments |
server.go |
handler | see suite |
| POST | /api/v1/docgov/comments |
s.handleDocGovAddComment |
server.go |
handler | see suite |
| POST | /api/v1/docgov/content |
s.handleDocGovSaveContent |
server.go |
handler | see suite |
| GET | /api/v1/docgov/document |
s.handleDocGovGetDocument |
server.go |
handler | see suite |
| GET | /api/v1/docgov/documents/{doc_id}/content |
s.handleDocGovGetDocumentContent |
server.go |
session+project | see suite |
| POST | /api/v1/docgov/lease/acquire |
s.handleDocGovAcquireLease |
server.go |
handler | see suite |
| POST | /api/v1/docgov/lease/heartbeat |
s.handleDocGovHeartbeatLease |
server.go |
handler | see suite |
| POST | /api/v1/docgov/lease/release |
s.handleDocGovReleaseLease |
server.go |
handler | see suite |
| POST | /api/v1/docgov/proposal/decide |
s.handleDocGovDecideProposal |
server.go |
handler | see suite |
| POST | /api/v1/docgov/review-decision |
s.handleDocGovReviewDecision |
server.go |
handler | see suite |
| POST | /api/v1/docgov/submit-review |
s.handleDocGovSubmitReview |
server.go |
handler | see suite |
| GET | /api/v1/documents/{doc_id}/agent-candidates/{candidate_id} |
s.handleDocRevisionGetCandidate |
document_revision_handlers.go |
session+project | see suite |
| POST | /api/v1/documents/{doc_id}/agent-candidates/{candidate_id}/decision |
s.handleDocRevisionCandidateDecision |
document_revision_handlers.go |
session+project | see suite |
| GET | /api/v1/documents/{doc_id}/change-reports/{report_id} |
s.handleDocRevisionGetReport |
document_revision_handlers.go |
session+project | see suite |
| PATCH | /api/v1/documents/{doc_id}/content |
s.handleDocRevisionPatchContent |
document_revision_handlers.go |
session+project | see suite |
| GET | /api/v1/documents/{doc_id}/diff |
s.handleDocRevisionDiff |
document_revision_handlers.go |
session+project | see suite |
| GET | /api/v1/documents/{doc_id}/manual-overlay |
s.handleDocRevisionManualOverlay |
document_revision_handlers.go |
session+project | see suite |
| GET | /api/v1/documents/{doc_id}/revision-state |
s.handleDocRevisionState |
document_revision_handlers.go |
session+project | see suite |
| GET | /api/v1/documents/{doc_id}/versions |
s.handleDocRevisionListVersions |
document_revision_handlers.go |
session+project | see suite |
| GET | /api/v1/documents/{doc_id}/versions/{version_no} |
s.handleDocRevisionGetVersion |
document_revision_handlers.go |
session+project | see suite |
| GET | /api/v1/freeform-documents |
s.handleListFreeformDocs |
server.go |
session+project | see suite |
| POST | /api/v1/freeform-documents |
s.handleCreateFreeformDoc |
server.go |
session+project | see suite |
| POST | /api/v1/freeform-documents/from-message |
s.handleCreateFreeformDocFromMessage |
server.go |
session+project | see suite |
| DELETE | /api/v1/freeform-documents/{doc_id} |
s.handleDeleteFreeformDoc |
server.go |
session+project | see suite |
| GET | /api/v1/freeform-documents/{doc_id} |
s.handleGetFreeformDoc |
server.go |
session+project | see suite |
| PUT | /api/v1/freeform-documents/{doc_id} |
s.handleUpdateFreeformDoc |
server.go |
session+project | see suite |
| POST | /api/v1/freeform-documents/{doc_id}/share |
s.handleShareFreeformDoc |
server.go |
session+project | see suite |
| POST | /api/v1/freeform-documents/{doc_id}/unshare |
s.handleUnshareFreeformDoc |
server.go |
session+project | see suite |
| GET | /api/v1/health |
s.handleHealth |
server.go |
public | see suite |
| GET | /api/v1/me/preferences |
s.handleMePreferences |
server.go |
handler | see suite |
| PUT | /api/v1/me/preferences |
s.handleMePreferences |
server.go |
handler | see suite |
| GET | /api/v1/me/profile |
s.handleMeProfile |
server.go |
handler | see suite |
| PATCH | /api/v1/me/profile |
s.handleMeProfile |
server.go |
handler | see suite |
| PATCH | /api/v1/notifications/{id} |
s.handlePatchNotification |
document_revision_handlers.go |
handler | see suite |
| GET | /api/v1/projects |
s.handleListProjects |
server.go |
session+project | see suite |
| POST | /api/v1/projects |
s.handleCreateProject |
server.go |
session+project | see suite |
| GET | /api/v1/projects/{id} |
s.handleGetProjectByID |
server.go |
session+project | see suite |
| POST | /api/v1/projects/{id}/activation-preview |
s.handleActivationPreview |
server.go |
session+project | see suite |
| PUT | /api/v1/projects/{id}/active-workflow |
s.handleActivateWorkflow |
server.go |
session+project | see suite |
| GET | /api/v1/projects/{id}/assets |
s.handleListProjectAssets |
server.go |
session+project | see suite |
| POST | /api/v1/projects/{id}/assets |
s.handleUploadProjectAsset |
server.go |
session+project | see suite |
| GET | /api/v1/projects/{id}/documents |
s.handleListProjectWorkflowDocuments |
server.go |
session+project | see suite |
| GET | /api/v1/projects/{id}/lineage |
s.handleGetProjectLineage |
server.go |
session+project | see suite |
| DELETE | /api/v1/projects/{id}/members |
s.handleProjectMembers |
server.go |
session+project | see suite |
| GET | /api/v1/projects/{id}/members |
s.handleProjectMembers |
server.go |
session+project | see suite |
| POST | /api/v1/projects/{id}/members |
s.handleProjectMembers |
server.go |
session+project | see suite |
| PUT | /api/v1/projects/{id}/members |
s.handleProjectMembers |
server.go |
session+project | see suite |
| GET | /api/v1/projects/{id}/notifications |
s.handleListProjectNotifications |
server.go |
session+project | see suite |
| GET | /api/v1/projects/{id}/settings |
s.handleGetProjectSettings |
server.go |
session+project | see suite |
| POST | /api/v1/projects/{id}/workflow-instances/activate |
s.handleActivateWorkflowInstance |
server.go |
session+project | see suite |
| PUT | /api/v1/projects/{id}/workflow-plan |
s.handleSaveWorkflowPlan |
server.go |
session+project | see suite |
| GET | /api/v1/projects/{id}/workflow-plan/default |
s.handleGetDefaultWorkflowPlan |
server.go |
session+project | see suite |
| GET | /api/v1/projects/{id}/workflows |
s.handleListProjectWorkflows |
server.go |
session+project | see suite |
| POST | /api/v1/projects/{id}/workflows/{workflow_key}/run |
s.handleRunProjectWorkflow |
server.go |
session+project | see suite |
| GET | /api/v1/projects/{id}/workflows/{workflow_key}/runs |
s.handleListProjectWorkflowRuns |
server.go |
session+project | see suite |
| GET | /api/v1/ready |
s.handleReadiness |
server.go |
public | see suite |
| POST | /api/v1/tasks/run |
s.handleRunTask |
server.go |
session+project | see suite |
| GET | /api/v1/tasks/run/stream |
s.handleRunTaskStream |
server.go |
session+project | see suite |
| POST | /api/v1/tasks/run/stream |
s.handleRunTaskStream |
server.go |
session+project | see suite |
| POST | /api/v1/tasks/runs |
s.handleCreateTaskRun |
server.go |
session+project | see suite |
| GET | /api/v1/tasks/runs/{run_id} |
s.handleGetTaskRun |
server.go |
session+project member (view) | see suite |
| POST | /api/v1/tasks/runs/{run_id}/cancel |
s.handleCancelTaskRun |
server.go |
session+run owner or project owner | see suite |
| GET | /api/v1/tasks/runs/{run_id}/events |
s.handleTaskRunEvents |
server.go |
session+project member (view) | see suite |
| POST | /api/v1/tasks/runs/{run_id}/resume |
s.handleResumeTaskRun |
server.go |
session+run owner or project owner | see suite |
| GET | /api/v1/workflow-instances/{id} |
s.handleGetWorkflowInstance |
server.go |
session+project | see suite |
| POST | /api/v1/workflow-instances/{id}/stages/{stage}/advance |
s.handleAdvanceStage |
server.go |
session+project | see suite |
| GET | /api/v1/workflow-instances/{id}/stages/{stage}/readiness |
s.handleGetStageReadiness |
server.go |
session+project | see suite |
| POST | /api/v1/workflow-instances/{id}/terminate |
s.handleTerminateWorkflowInstance |
server.go |
session+project | see suite |
| GET | /api/v1/workflow-instances/{id}/termination-preview |
s.handleTerminationPreview |
server.go |
session+project | see suite |
| GET | /api/v1/workflows |
s.handleListWorkflowDefinitions |
server.go |
session+project | see suite |
| GET | /api/v1/workflows/catalog |
s.handleWorkflowCatalog |
server.go |
session+project | see suite |
| GET | /health |
s.handleHealth |
server.go |
public | see suite |
| GET | /ready |
s.handleReadiness |
server.go |
public | see suite |
| * | /sse |
func(w http.ResponseWriter, r *http.Request |
task_run_idempotent_sse_test.go |
handler | see suite |
Total routes: 133
Session interrupt fail-closed
When IAM/auth store unavailable after session established, protected reads must reject (see TestAuthStore_SessionInterruptFailClosed).
BUG-11 410 policy
Product decision 2026-09-16: retain WORKFLOW_SWITCH_API_RETIRED 410 when governance available; legacy path only when governance unavailable. Not a capability gap.