Endpoint Reference
The full SPAPS app composes route groups in create_spaps_app. This page separates exact operational endpoint claims from domain mount claims so the docs contract can validate each one with the right evidence.
This is a compact operational map, not the complete API reference. The verified 2026-09-03 upstream manifest contains 448 method/path entries. Use the generated manifest or live OpenAPI for implementation work.
Always-on Operational Routes
These rows are exact path claims. Each path must be backed by operational_routes[].path or operational_routes[].effective_path in the docs contract fixture.
| Route | Purpose |
|---|---|
GET /health | Basic process health |
GET /health/ready | Database, Redis, and PII-readiness checks |
GET /health/local-mode | Local-mode status and hints |
GET /api/metrics | Prometheus text metrics |
GET /api/metrics/json | JSON metrics |
Mounted Route Groups
These rows are domain and prefix mount claims. A shared prefix such as /api means the router group mounts under that namespace; it does not prove that any arbitrary child path exists.
| Tag group | Router variable | Prefix |
|---|---|---|
| auth | auth_router | /api |
| sessions | sessions_router | /api |
| users | users_router | /api |
| solana / ethereum | wallet routers | /api |
| admin applications | admin_router | /api |
| entitlements and mappings | entitlements_router, mappings_router | /api |
| stripe products, checkout, subscriptions, history, portal, webhooks | stripe routers | /api |
| email and webhooks | email_router, webhooks_router, mailgun_router | /api |
| secure messages | secure_messages_router | /api |
| policies | policies_router | /api |
How To Inspect Exact Paths
Use the checked-in manifest when you need source-review evidence without a server:
jq -r '.endpoints[] | [.method, .path, .category] | @tsv' docs/manifest.json
jq -r '.endpoints | group_by(.category)[] | [.[0].category, length] | @tsv' docs/manifest.jsonUse FastAPI’s generated OpenAPI output when you need runtime evidence:
make local-proof-up
curl http://localhost:3301/openapi.json | jq '.paths | keys[]'To inspect one endpoint’s authorization contract in the manifest:
jq '.endpoints[] | select(.path == "/api/token-gates/verify" and .method == "POST") |
{method, path, category, auth, rate_tier, publishable_scope, entitlement_key}' docs/manifest.jsonThe manifest and OpenAPI answer different questions: the manifest carries repository-owned auth, rate-tier, documentation, and test evidence; OpenAPI proves what the selected runtime actually mounted. A mismatch is a release blocker, not permission to choose whichever result is convenient.
If you change an endpoint, update docs and docs/manifest.json alongside the code. The repo has
contract tests for manifest parity.