Public Endpoint Index

Every HTTP endpoint a client outside the platform can reach, generated from the Spring mapping annotations of the services and the gateway route table, with the permission it requires and the page that documents it.

What counts as public#

An endpoint is public when a request from outside the cluster can reach it:

• a kelta-worker or kelta-ai mapping is public when a gateway route reaches it — one of the gateway’s static routes (/api/admin/**, /api/flows/**, /api/ai/**, …) or the per-collection route every collection gets (/api/{collection}/**, which also covers the system collections);
• every kelta-auth mapping is public: kelta-auth has its own ingress, which sends every path of the auth host to it, so its own security chain is the gate;
• every kelta-mcp mapping is public: kelta-mcp is reached on the API origin at /{tenantSlug}/mcp/... without a gateway route, authenticates the caller’s personal access token, and forwards each tool call through the gateway, which authorizes it.

A worker mapping that no gateway route reaches (the /internal/** service-to-service endpoints, for example) is not public. Those are left out of the table and only counted at the end of the page.

Paths are relative to the API host, except the auth rows, which are on the auth host. Behind the gateway, a tenant’s requests may also carry its slug first (/{tenantSlug}/api/...); the gateway strips it before routing.

Reading the permission column#

• none (unauthenticated) — the path is in the gateway’s unauthenticated-paths; the endpoint verifies the caller itself (a signature, a signed token).
• none (public read) — a GET under the gateway’s public-paths (UI bootstrap metadata), served without a token for the resolved tenant.
• API_ACCESS — the gateway checks the API_ACCESS system permission on every authenticated call.
• API_ACCESS + <collection> grant or <PERMISSION> — a static route that fronts a system collection: the gateway also checks the caller’s grant on that collection for the HTTP method, or for a write the named system permission.
• API_ACCESS + collection grant — a per-collection route: the collection’s object permission for the HTTP method (read, create, edit, delete).
• A further + PERMISSION is a system permission the gateway checks for that method and path.
• ; handler checks A / B — system permissions the handler (or a require…/check… helper in its class) references, found statically: one of them may be required, or each may gate a different branch — the linked page says which. A check made in a service the handler calls is not seen here.
• none (permitAll) and kelta-auth session — kelta-auth’s security chain: open, or a signed-in session (or bearer token) required.

internal marks an endpoint only the platform’s own admin UI or services call; it is reachable, but not a supported integration surface and may change without notice.

404 public endpoints: 312 linked to docs, 29 internal, 63 not yet documented.

Endpoints#

Method	Path	Service	Permission	Docs
GET	/api/_search	worker	API_ACCESS	api/querying
POST	/api/admin/authorization/test	worker	API_ACCESS; handler checks MANAGE_USERS	internal — Backs the admin console’s authorization tester, which asks Cerbos whether a user/resource/action would be allowed; it changes nothing.
GET	/api/admin/campaigns	worker	API_ACCESS; handler checks MANAGE_CAMPAIGNS	platform/messaging
POST	/api/admin/campaigns	worker	API_ACCESS; handler checks MANAGE_CAMPAIGNS	platform/messaging
GET	/api/admin/campaigns/suppressions	worker	API_ACCESS; handler checks MANAGE_CAMPAIGNS	platform/messaging
POST	/api/admin/campaigns/suppressions	worker	API_ACCESS; handler checks MANAGE_CAMPAIGNS	platform/messaging
DELETE	/api/admin/campaigns/suppressions	worker	API_ACCESS; handler checks MANAGE_CAMPAIGNS	platform/messaging
GET	/api/admin/campaigns/{id}	worker	API_ACCESS; handler checks MANAGE_CAMPAIGNS	platform/messaging
PATCH	/api/admin/campaigns/{id}	worker	API_ACCESS; handler checks MANAGE_CAMPAIGNS	platform/messaging
DELETE	/api/admin/campaigns/{id}	worker	API_ACCESS; handler checks MANAGE_CAMPAIGNS	platform/messaging
POST	/api/admin/campaigns/{id}/cancel	worker	API_ACCESS; handler checks MANAGE_CAMPAIGNS	platform/messaging
GET	/api/admin/campaigns/{id}/recipients	worker	API_ACCESS; handler checks MANAGE_CAMPAIGNS	platform/messaging
POST	/api/admin/campaigns/{id}/schedule	worker	API_ACCESS; handler checks MANAGE_CAMPAIGNS	platform/messaging
POST	/api/admin/campaigns/{id}/send	worker	API_ACCESS; handler checks MANAGE_CAMPAIGNS	platform/messaging
GET	/api/admin/campaigns/{id}/stats	worker	API_ACCESS; handler checks MANAGE_CAMPAIGNS	platform/messaging
POST	/api/admin/campaigns/{id}/test	worker	API_ACCESS; handler checks MANAGE_CAMPAIGNS	platform/messaging
GET	/api/admin/collections/{name}/unique-constraints	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	data-model/validation-rules
POST	/api/admin/collections/{name}/unique-constraints	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	data-model/validation-rules
DELETE	/api/admin/collections/{name}/unique-constraints/{indexName}	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	data-model/validation-rules
GET	/api/admin/delegated-admin-scopes	worker	API_ACCESS; handler checks MANAGE_DELEGATED_ADMINS	security/users-and-groups
POST	/api/admin/delegated-admin-scopes	worker	API_ACCESS; handler checks MANAGE_DELEGATED_ADMINS	security/users-and-groups
GET	/api/admin/delegated-admin-scopes/{id}	worker	API_ACCESS; handler checks MANAGE_DELEGATED_ADMINS	security/users-and-groups
PATCH	/api/admin/delegated-admin-scopes/{id}	worker	API_ACCESS; handler checks MANAGE_DELEGATED_ADMINS	security/users-and-groups
DELETE	/api/admin/delegated-admin-scopes/{id}	worker	API_ACCESS; handler checks MANAGE_DELEGATED_ADMINS	security/users-and-groups
GET	/api/admin/delegated/me	worker	API_ACCESS	security/users-and-groups
GET	/api/admin/delegated/users	worker	API_ACCESS	security/users-and-groups
POST	/api/admin/delegated/users	worker	API_ACCESS	security/users-and-groups
PATCH	/api/admin/delegated/users/{id}	worker	API_ACCESS	security/users-and-groups
POST	/api/admin/delegated/users/{id}/invite	worker	API_ACCESS	security/users-and-groups
POST	/api/admin/delegated/users/{id}/reset-password	worker	API_ACCESS	security/users-and-groups
GET	/api/admin/domains	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	platform/tenants
POST	/api/admin/domains	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	platform/tenants
DELETE	/api/admin/domains/{domainId}	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	platform/tenants
POST	/api/admin/domains/{domainId}/verify	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	platform/tenants
GET	/api/admin/email-templates	worker	API_ACCESS; handler checks MANAGE_EMAIL_TEMPLATES	platform/messaging
POST	/api/admin/email-templates/{templateKey}/override	worker	API_ACCESS; handler checks MANAGE_EMAIL_TEMPLATES	platform/messaging
DELETE	/api/admin/email-templates/{templateKey}/override	worker	API_ACCESS; handler checks MANAGE_EMAIL_TEMPLATES	platform/messaging
GET	/api/admin/mfa/policy	worker	API_ACCESS; handler checks MANAGE_USERS	security/mfa-and-password-policy
PUT	/api/admin/mfa/policy	worker	API_ACCESS; handler checks MANAGE_USERS	security/mfa-and-password-policy
POST	/api/admin/mfa/users/{userId}/reset	worker	API_ACCESS; handler checks MANAGE_USERS	security/mfa-and-password-policy
GET	/api/admin/mfa/users/{userId}/status	worker	API_ACCESS; handler checks MANAGE_USERS	security/mfa-and-password-policy
POST	/api/admin/notifications	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	platform/messaging
GET	/api/admin/observability-settings	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	platform/audit-and-monitoring
PUT	/api/admin/observability-settings	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	platform/audit-and-monitoring
GET	/api/admin/observability/audit	worker	API_ACCESS; handler checks VIEW_SETUP	internal — Backs the Activity view of the admin console’s Monitoring pages; the query shape follows that UI and is not a supported API.
GET	/api/admin/observability/logs	worker	API_ACCESS; handler checks VIEW_SETUP	internal — Backs the Logs view of the admin console’s Monitoring pages; the query shape follows that UI and is not a supported API.
GET	/api/admin/observability/otlp-target	worker	API_ACCESS; handler checks VIEW_SETUP	platform/audit-and-monitoring
PUT	/api/admin/observability/otlp-target	worker	API_ACCESS; handler checks VIEW_SETUP	platform/audit-and-monitoring
DELETE	/api/admin/observability/otlp-target	worker	API_ACCESS; handler checks VIEW_SETUP	platform/audit-and-monitoring
GET	/api/admin/observability/request-logs	worker	API_ACCESS; handler checks VIEW_SETUP	internal — Backs the Requests view (and its request detail) of the admin console’s Monitoring pages; not a supported API.
GET	/api/admin/observability/request-logs/{traceId}	worker	API_ACCESS; handler checks VIEW_SETUP	internal — Backs the Requests view (and its request detail) of the admin console’s Monitoring pages; not a supported API.
GET	/api/admin/password-policy	worker	API_ACCESS; handler checks MANAGE_USERS	security/mfa-and-password-policy
PUT	/api/admin/password-policy	worker	API_ACCESS; handler checks MANAGE_USERS	security/mfa-and-password-policy
POST	/api/admin/password-policy/users/{userId}/unlock	worker	API_ACCESS; handler checks MANAGE_USERS	security/mfa-and-password-policy
GET	/api/admin/profiles/{profileId}/custom-rules	worker	API_ACCESS; handler checks MANAGE_USERS	internal — Backs the custom ABAC rule editor on the admin console’s profile page (CustomPolicyEditor); no client outside the console calls it.
POST	/api/admin/profiles/{profileId}/custom-rules	worker	API_ACCESS; handler checks MANAGE_USERS	internal — Backs the custom ABAC rule editor on the admin console’s profile page (CustomPolicyEditor); no client outside the console calls it.
PUT	/api/admin/profiles/{profileId}/custom-rules/{ruleId}	worker	API_ACCESS; handler checks MANAGE_USERS	internal — Backs the custom ABAC rule editor on the admin console’s profile page (CustomPolicyEditor); no client outside the console calls it.
DELETE	/api/admin/profiles/{profileId}/custom-rules/{ruleId}	worker	API_ACCESS; handler checks MANAGE_USERS	internal — Backs the custom ABAC rule editor on the admin console’s profile page (CustomPolicyEditor); no client outside the console calls it.
GET	/api/admin/search-reindex	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	data-model/search-and-attachments
POST	/api/admin/search-reindex	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	data-model/search-and-attachments
GET	/api/admin/tenant/email-settings	worker	API_ACCESS; handler checks MANAGE_TENANTS	platform/messaging
PUT	/api/admin/tenant/email-settings	worker	API_ACCESS; handler checks MANAGE_TENANTS	platform/messaging
POST	/api/admin/tenant/email-settings/test	worker	API_ACCESS; handler checks MANAGE_TENANTS	platform/messaging
GET	/api/admin/tenant/portal-auth-settings	worker	API_ACCESS; handler checks MANAGE_USERS	security/authentication
PUT	/api/admin/tenant/portal-auth-settings	worker	API_ACCESS; handler checks MANAGE_USERS	security/authentication
POST	/api/admin/users/portal-invite	worker	API_ACCESS; handler checks MANAGE_USERS	security/users-and-groups
POST	/api/admin/users/{id}/anonymize	worker	API_ACCESS; handler checks MANAGE_USERS	security/users-and-groups
GET	/api/admin/users/{id}/tokens	worker	API_ACCESS; handler checks MANAGE_USERS	security/personal-access-tokens
POST	/api/admin/users/{id}/tokens	worker	API_ACCESS; handler checks MANAGE_USERS	security/personal-access-tokens
DELETE	/api/admin/users/{id}/tokens/{tokenId}	worker	API_ACCESS; handler checks MANAGE_USERS	security/personal-access-tokens
POST	/api/admin/users/{userId}/invite	worker	API_ACCESS; handler checks MANAGE_USERS	security/users-and-groups
POST	/api/admin/users/{userId}/reset-password	worker	API_ACCESS; handler checks MANAGE_USERS	security/mfa-and-password-policy
GET	/api/ai/agents	ai	API_ACCESS	console/ai-assistant
POST	/api/ai/agents	ai	API_ACCESS	console/ai-assistant
GET	/api/ai/agents/{id}	ai	API_ACCESS	console/ai-assistant
PUT	/api/ai/agents/{id}	ai	API_ACCESS	console/ai-assistant
DELETE	/api/ai/agents/{id}	ai	API_ACCESS	console/ai-assistant
GET	/api/ai/agents/{id}/executions	ai	API_ACCESS	console/ai-assistant
POST	/api/ai/agents/{id}/run	ai	API_ACCESS	console/ai-assistant
POST	/api/ai/chat	ai	API_ACCESS	console/ai-assistant
POST	/api/ai/chat/stream	ai	API_ACCESS	console/ai-assistant
GET	/api/ai/config	ai	API_ACCESS	console/ai-assistant
PUT	/api/ai/config	ai	API_ACCESS	console/ai-assistant
GET	/api/ai/conversations	ai	API_ACCESS	console/ai-assistant
GET	/api/ai/conversations/{id}	ai	API_ACCESS	console/ai-assistant
GET	/api/ai/conversations/{id}/messages	ai	API_ACCESS	console/ai-assistant
POST	/api/ai/flows/generate	ai	API_ACCESS	console/ai-assistant
POST	/api/ai/proposals/{id}/apply	ai	API_ACCESS	console/ai-assistant
GET	/api/ai/usage	ai	API_ACCESS	console/ai-assistant
GET	/api/alerts/latency	worker	API_ACCESS	undocumented
POST	/api/analytics/events	worker	API_ACCESS	undocumented
GET	/api/api-operations/search	worker	API_ACCESS + collection grant	data-model/external-collections
POST	/api/api-specs/import	worker	API_ACCESS + collection grant	data-model/external-collections
GET	/api/api-specs/library	worker	API_ACCESS + collection grant	data-model/external-collections
POST	/api/api-specs/validate	worker	API_ACCESS + collection grant	data-model/external-collections
DELETE	/api/api-specs/{id}	worker	API_ACCESS + collection grant	data-model/external-collections
GET	/api/api-specs/{id}/details	worker	API_ACCESS + collection grant	data-model/external-collections
GET	/api/api-specs/{id}/operations	worker	API_ACCESS + collection grant	data-model/external-collections
GET	/api/api-specs/{id}/raw	worker	API_ACCESS + collection grant	data-model/external-collections
GET	/api/api-specs/{specId}/operations/{opId}	worker	API_ACCESS + collection grant	data-model/external-collections
POST	/api/api-specs/{specId}/operations/{opId}/materialize	worker	API_ACCESS + collection grant	data-model/external-collections
GET	/api/approvals/history	worker	API_ACCESS	automation/approvals
GET	/api/approvals/lock-status	worker	API_ACCESS	automation/approvals
GET	/api/approvals/status	worker	API_ACCESS	automation/approvals
POST	/api/approvals/submit	worker	API_ACCESS	automation/approvals
POST	/api/approvals/{instanceId}/approve	worker	API_ACCESS	automation/approvals
POST	/api/approvals/{instanceId}/recall	worker	API_ACCESS	automation/approvals
POST	/api/approvals/{instanceId}/reject	worker	API_ACCESS	automation/approvals
POST	/api/attachments/upload-url	worker	API_ACCESS + collection grant	data-model/search-and-attachments
DELETE	/api/attachments/{id}	worker	API_ACCESS + collection grant	data-model/search-and-attachments
POST	/api/attachments/{id}/finalize	worker	API_ACCESS + collection grant	data-model/search-and-attachments
GET	/api/bulk-jobs	worker	API_ACCESS; handler checks MANAGE_DATA	api/overview
POST	/api/bulk-jobs	worker	API_ACCESS; handler checks MANAGE_DATA	api/overview
POST	/api/bulk-jobs/upload	worker	API_ACCESS; handler checks MANAGE_DATA	api/overview
GET	/api/bulk-jobs/{id}	worker	API_ACCESS; handler checks MANAGE_DATA	api/overview
POST	/api/bulk-jobs/{id}/abort	worker	API_ACCESS; handler checks MANAGE_DATA	api/overview
GET	/api/bulk-jobs/{id}/results	worker	API_ACCESS; handler checks MANAGE_DATA	api/overview
GET	/api/bulk-jobs/{id}/results/download	worker	API_ACCESS; handler checks MANAGE_DATA	api/overview
GET	/api/chat/conversations	worker	API_ACCESS; handler checks MANAGE_CHAT	undocumented
POST	/api/chat/conversations	worker	API_ACCESS	undocumented
GET	/api/chat/conversations/{id}	worker	API_ACCESS	undocumented
POST	/api/chat/conversations/{id}/assign	worker	API_ACCESS	undocumented
POST	/api/chat/conversations/{id}/close	worker	API_ACCESS	undocumented
GET	/api/chat/conversations/{id}/messages	worker	API_ACCESS	undocumented
POST	/api/chat/conversations/{id}/messages	worker	API_ACCESS	undocumented
POST	/api/chat/conversations/{id}/read-receipt	worker	API_ACCESS	undocumented
POST	/api/collections/{collectionName}/duplicates	worker	API_ACCESS; handler checks MANAGE_DATA	api/overview
POST	/api/collections/{collectionName}/import/csv	worker	API_ACCESS	api/overview
PUT	/api/collections/{collectionName}/layouts/{layoutName}/tree	worker	API_ACCESS + collections grant or CUSTOMIZE_APPLICATION	reference/page-layouts
POST	/api/collections/{collectionName}/merge	worker	API_ACCESS; handler checks MANAGE_DATA	api/overview
GET	/api/collections/{name}/schema	worker	API_ACCESS	data-model/collections
GET	/api/config-health	worker	API_ACCESS	internal — Backs the Health view of the admin console’s Monitoring pages, which scores the tenant’s configuration; not a supported API.
GET	/api/connected-apps/{appId}/audit	worker	API_ACCESS	security/connected-apps
GET	/api/connected-apps/{appId}/tokens	worker	API_ACCESS	security/connected-apps
POST	/api/connected-apps/{appId}/tokens	worker	API_ACCESS + connected-apps grant or MANAGE_CONNECTED_APPS	security/connected-apps
DELETE	/api/connected-apps/{appId}/tokens/{tokenId}	worker	API_ACCESS + connected-apps grant or MANAGE_CONNECTED_APPS	security/connected-apps
POST	/api/credentials/oauth/complete	worker	API_ACCESS + collection grant	internal — Second half of the admin console’s OAuth popup: it exchanges the provider’s code and stores the tokens on the credential.
GET	/api/credentials/templates	worker	API_ACCESS + collection grant	internal — Catalogue of preset credential templates for the admin console’s credential editor; it carries no tenant data.
POST	/api/credentials/test	worker	API_ACCESS + collection grant	internal — The Test button of the admin console’s credential editor, before the credential is saved.
GET	/api/credentials/types	worker	API_ACCESS + collection grant	internal — Catalogue of credential types the admin console’s credential editor offers; it carries no tenant data.
POST	/api/credentials/{id}/oauth/authorize-url	worker	API_ACCESS + collection grant	internal — First half of the admin console’s OAuth popup for an OAuth credential: it builds the provider’s authorize URL.
POST	/api/credentials/{id}/test	worker	API_ACCESS + collection grant	internal — The Test button of the admin console’s credential editor, for a saved credential.
POST	/api/dashboards/{dashboardId}/components/{componentId}/data	worker	API_ACCESS; handler checks MANAGE_REPORTS / VIEW_ANALYTICS	mcp/tools
POST	/api/dashboards/{dashboardId}/data	worker	API_ACCESS; handler checks MANAGE_REPORTS / VIEW_ANALYTICS	mcp/tools
POST	/api/dashboards/{dashboardId}/validate	worker	API_ACCESS + dashboards grant or MANAGE_REPORTS; handler checks VIEW_ANALYTICS	mcp/tools
GET	/api/dashboards/{name}/tree	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	console/dashboards-and-reports
PUT	/api/dashboards/{name}/tree	worker	API_ACCESS + dashboards grant or MANAGE_REPORTS; handler checks CUSTOMIZE_APPLICATION	console/dashboards-and-reports
GET	/api/data-exports	worker	API_ACCESS; handler checks VIEW_ALL_DATA	platform/data-retention
POST	/api/data-exports	worker	API_ACCESS; handler checks VIEW_ALL_DATA	platform/data-retention
GET	/api/data-exports/{id}	worker	API_ACCESS; handler checks VIEW_ALL_DATA	platform/data-retention
POST	/api/data-exports/{id}/cancel	worker	API_ACCESS; handler checks VIEW_ALL_DATA	platform/data-retention
GET	/api/data-exports/{id}/download	worker	API_ACCESS; handler checks VIEW_ALL_DATA	platform/data-retention
GET	/api/devices	worker	API_ACCESS	platform/messaging
POST	/api/devices	worker	API_ACCESS	platform/messaging
GET	/api/devices/vapid-public-key	worker	API_ACCESS	platform/messaging
DELETE	/api/devices/{deviceId}	worker	API_ACCESS	platform/messaging
GET	/api/docs	worker	API_ACCESS	api/overview
GET	/api/docs/openapi.json	worker	API_ACCESS	api/overview
GET	/api/email/logs	worker	API_ACCESS; handler checks MANAGE_EMAIL_TEMPLATES	platform/messaging
POST	/api/email/send	worker	API_ACCESS; handler checks MANAGE_EMAIL_TEMPLATES	platform/messaging
GET	/api/environments	worker	API_ACCESS; handler checks MANAGE_SANDBOXES	platform/environments-and-promotion
POST	/api/environments	worker	API_ACCESS; handler checks MANAGE_SANDBOXES	platform/environments-and-promotion
GET	/api/environments/{envId}	worker	API_ACCESS; handler checks MANAGE_SANDBOXES	platform/environments-and-promotion
PATCH	/api/environments/{envId}	worker	API_ACCESS; handler checks MANAGE_SANDBOXES	platform/environments-and-promotion
DELETE	/api/environments/{envId}	worker	API_ACCESS; handler checks MANAGE_SANDBOXES	platform/environments-and-promotion
POST	/api/environments/{envId}/archive	worker	API_ACCESS	platform/environments-and-promotion
GET	/api/environments/{envId}/diff	worker	API_ACCESS; handler checks MANAGE_SANDBOXES	platform/environments-and-promotion
POST	/api/environments/{envId}/refresh	worker	API_ACCESS; handler checks MANAGE_SANDBOXES	platform/environments-and-promotion
GET	/api/environments/{envId}/snapshots	worker	API_ACCESS; handler checks MANAGE_SANDBOXES	platform/environments-and-promotion
POST	/api/environments/{envId}/snapshots	worker	API_ACCESS; handler checks MANAGE_SANDBOXES	platform/environments-and-promotion
POST	/api/environments/{envId}/test	worker	API_ACCESS; handler checks MANAGE_SANDBOXES	platform/environments-and-promotion
GET	/api/files/**	worker	API_ACCESS	data-model/search-and-attachments
GET	/api/flows/executions/{executionId}	worker	API_ACCESS	automation/flow-runs
POST	/api/flows/executions/{executionId}/cancel	worker	API_ACCESS + flows grant or MANAGE_WORKFLOWS	automation/flow-runs
POST	/api/flows/executions/{executionId}/retry	worker	API_ACCESS + flows grant or MANAGE_WORKFLOWS	automation/flow-runs
GET	/api/flows/executions/{executionId}/steps	worker	API_ACCESS	automation/flow-runs
GET	/api/flows/record-executions	worker	API_ACCESS	automation/flow-runs
GET	/api/flows/resources	worker	API_ACCESS	internal — Backs the flow designer’s step palette: the task resources (built-in and from runtime modules) a Task state can name.
POST	/api/flows/{flowId}/execute	worker	API_ACCESS; handler checks MANAGE_WORKFLOWS	automation/triggers
GET	/api/flows/{flowId}/flow-executions	worker	API_ACCESS	automation/flow-runs
POST	/api/flows/{flowId}/publish	worker	API_ACCESS + flows grant or MANAGE_WORKFLOWS	automation/flow-runs
GET	/api/flows/{flowId}/runs	worker	API_ACCESS	automation/triggers
GET	/api/flows/{flowId}/schedule	worker	API_ACCESS	automation/triggers
GET	/api/flows/{flowId}/versions	worker	API_ACCESS	automation/flow-runs
GET	/api/flows/{flowId}/versions/{versionNumber}	worker	API_ACCESS	automation/flow-runs
GET	/api/flows/{flowId}/webhook-url	worker	API_ACCESS	automation/triggers
DELETE	/api/global-picklists/{id}	worker	API_ACCESS + global-picklists grant or CUSTOMIZE_APPLICATION	cli/commands
GET	/api/governor-limits	worker	API_ACCESS; handler checks VIEW_SETUP	platform/governor-limits
PUT	/api/governor-limits	worker	API_ACCESS; handler checks MANAGE_TENANTS	platform/governor-limits
PUT	/api/governor-limits/tier	worker	API_ACCESS; handler checks MANAGE_TENANTS	platform/governor-limits
GET	/api/images/**	worker	API_ACCESS	data-model/search-and-attachments
GET	/api/me/identity	worker	API_ACCESS	api/authentication
GET	/api/me/notifications	worker	API_ACCESS	automation/action-handlers
POST	/api/me/notifications/read-all	worker	API_ACCESS	automation/action-handlers
POST	/api/me/notifications/{id}/read	worker	API_ACCESS	automation/action-handlers
GET	/api/me/permissions	worker	API_ACCESS	api/authentication
GET	/api/me/profile	worker	API_ACCESS	api/authentication
PATCH	/api/me/profile	worker	API_ACCESS	api/authentication
GET	/api/me/tokens	worker	API_ACCESS	security/personal-access-tokens
POST	/api/me/tokens	worker	API_ACCESS	security/personal-access-tokens
GET	/api/me/tokens/validate/{tokenHash}	worker	API_ACCESS	internal — Called by the gateway, not by clients: it validates a PAT by its hash when the token is not in the gateway’s Redis cache.
DELETE	/api/me/tokens/{tokenId}	worker	API_ACCESS	security/personal-access-tokens
POST	/api/metadata/deployment-plan	worker	API_ACCESS	internal — Backs the admin console’s metadata dependency views (graph, impact of a change, deployment order); read-only and shaped for that UI.
GET	/api/metadata/graph	worker	API_ACCESS	internal — Backs the admin console’s metadata dependency views (graph, impact of a change, deployment order); read-only and shaped for that UI.
GET	/api/metadata/impact	worker	API_ACCESS	internal — Backs the admin console’s metadata dependency views (graph, impact of a change, deployment order); read-only and shaped for that UI.
GET	/api/metrics/endpoints	worker	API_ACCESS	internal — Backs the Overview, Errors and Performance views of the admin console’s Monitoring pages (volume, error and latency aggregates); not a supported API.
GET	/api/metrics/errors	worker	API_ACCESS	internal — Backs the Overview, Errors and Performance views of the admin console’s Monitoring pages (volume, error and latency aggregates); not a supported API.
GET	/api/metrics/latency	worker	API_ACCESS	internal — Backs the Overview, Errors and Performance views of the admin console’s Monitoring pages (volume, error and latency aggregates); not a supported API.
GET	/api/metrics/query	worker	API_ACCESS	internal — Backs the Overview, Errors and Performance views of the admin console’s Monitoring pages (volume, error and latency aggregates); not a supported API.
GET	/api/metrics/summary	worker	API_ACCESS	internal — Backs the Overview, Errors and Performance views of the admin console’s Monitoring pages (volume, error and latency aggregates); not a supported API.
POST	/api/migrations/execute	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	platform/environments-and-promotion
POST	/api/migrations/plan	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	platform/environments-and-promotion
POST	/api/migrations/snapshot	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	platform/environments-and-promotion
GET	/api/migrations/versions	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	platform/environments-and-promotion
POST	/api/migrations/{runId}/rollback	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	platform/environments-and-promotion
GET	/api/modules	worker	API_ACCESS	platform/modules
POST	/api/modules/install	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	platform/modules
POST	/api/modules/install-jar	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	platform/modules
GET	/api/modules/signing-keys	worker	API_ACCESS	platform/modules
POST	/api/modules/signing-keys	worker	API_ACCESS + MANAGE_CREDENTIALS	platform/modules
DELETE	/api/modules/signing-keys/{id}	worker	API_ACCESS + MANAGE_CREDENTIALS	platform/modules
POST	/api/modules/signing-keys/{id}/activate	worker	API_ACCESS + MANAGE_CREDENTIALS	platform/modules
POST	/api/modules/signing-keys/{id}/retire	worker	API_ACCESS + MANAGE_CREDENTIALS	platform/modules
POST	/api/modules/webhooks/{tenantId}/{moduleId}	worker	none (unauthenticated)	platform/modules
DELETE	/api/modules/{moduleId}	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	platform/modules
GET	/api/modules/{moduleId}/actions	worker	API_ACCESS	platform/modules
POST	/api/modules/{moduleId}/disable	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	platform/modules
POST	/api/modules/{moduleId}/enable	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	platform/modules
GET	/api/modules/{moduleId}/health	worker	API_ACCESS	platform/modules
GET	/api/modules/{moduleId}/provisioned-resources	worker	API_ACCESS	platform/modules
GET	/api/modules/{moduleId}/ui-bundle.js	worker	API_ACCESS	sdk/plugin-sdk
GET	/api/modules/{moduleId}/x/**	worker	API_ACCESS	platform/modules
POST	/api/modules/{moduleId}/x/**	worker	API_ACCESS	platform/modules
PUT	/api/modules/{moduleId}/x/**	worker	API_ACCESS	platform/modules
PATCH	/api/modules/{moduleId}/x/**	worker	API_ACCESS	platform/modules
DELETE	/api/modules/{moduleId}/x/**	worker	API_ACCESS	platform/modules
POST	/api/operations	worker	API_ACCESS	api/overview
POST	/api/packages/export	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	platform/environments-and-promotion
GET	/api/packages/history	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	platform/environments-and-promotion
POST	/api/packages/import	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	platform/environments-and-promotion
POST	/api/packages/import/preview	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	platform/environments-and-promotion
GET	/api/page-layouts/{layoutId}/tree	worker	API_ACCESS; handler checks CUSTOMIZE_APPLICATION	reference/page-layouts
PUT	/api/page-layouts/{layoutId}/tree	worker	API_ACCESS + page-layouts grant or CUSTOMIZE_APPLICATION	reference/page-layouts
GET	/api/pages/config-schema	worker	API_ACCESS	reference/ui-pages
GET	/api/pages/widgets	worker	API_ACCESS	reference/ui-pages
GET	/api/pages/{slug}/render	worker	API_ACCESS	internal — The end-user app’s renderer for published custom pages (/app/p/): it returns the page config the app draws, not data.
POST	/api/picklist-values	worker	API_ACCESS + collection grant	data-model/picklists-and-record-types
GET	/api/promotions	worker	API_ACCESS; handler checks MANAGE_SANDBOXES	platform/environments-and-promotion
POST	/api/promotions	worker	API_ACCESS; handler checks MANAGE_SANDBOXES	platform/environments-and-promotion
GET	/api/promotions/preview	worker	API_ACCESS; handler checks MANAGE_SANDBOXES	platform/environments-and-promotion
GET	/api/promotions/{promotionId}	worker	API_ACCESS; handler checks MANAGE_SANDBOXES	platform/environments-and-promotion
POST	/api/promotions/{promotionId}/approve	worker	API_ACCESS; handler checks MANAGE_SANDBOXES	platform/environments-and-promotion
POST	/api/promotions/{promotionId}/execute	worker	API_ACCESS; handler checks MANAGE_SANDBOXES	platform/environments-and-promotion
GET	/api/promotions/{promotionId}/items	worker	API_ACCESS; handler checks MANAGE_SANDBOXES	platform/environments-and-promotion
POST	/api/promotions/{promotionId}/rollback	worker	API_ACCESS; handler checks MANAGE_SANDBOXES	platform/environments-and-promotion
POST	/api/reports/{reportId}/execute	worker	API_ACCESS; handler checks MANAGE_REPORTS / VIEW_ANALYTICS	console/dashboards-and-reports
GET	/api/reports/{reportId}/export	worker	API_ACCESS; handler checks MANAGE_REPORTS / VIEW_ANALYTICS	console/dashboards-and-reports
POST	/api/scheduled-jobs/validate-cron	worker	API_ACCESS + scheduled-jobs grant or MANAGE_WORKFLOWS	automation/triggers
POST	/api/scheduled-jobs/{id}/execute	worker	API_ACCESS + scheduled-jobs grant or MANAGE_WORKFLOWS	automation/triggers
POST	/api/scheduled-jobs/{id}/pause	worker	API_ACCESS + scheduled-jobs grant or MANAGE_WORKFLOWS	automation/triggers
POST	/api/scheduled-jobs/{id}/resume	worker	API_ACCESS + scheduled-jobs grant or MANAGE_WORKFLOWS	automation/triggers
POST	/api/scripts/{id}/execute	worker	API_ACCESS	automation/action-handlers
GET	/api/superset/dashboards	worker	API_ACCESS	console/dashboards-and-reports
GET	/api/superset/datasets	worker	API_ACCESS	console/dashboards-and-reports
POST	/api/superset/datasets/sync	worker	API_ACCESS	console/dashboards-and-reports
POST	/api/superset/guest-token	worker	API_ACCESS	console/dashboards-and-reports
GET	/api/support/mailboxes	worker	API_ACCESS; handler checks MANAGE_SUPPORT_MAILBOX	undocumented
POST	/api/support/mailboxes	worker	API_ACCESS; handler checks MANAGE_SUPPORT_MAILBOX	undocumented
GET	/api/support/mailboxes/{id}	worker	API_ACCESS; handler checks MANAGE_SUPPORT_MAILBOX	undocumented
PATCH	/api/support/mailboxes/{id}	worker	API_ACCESS; handler checks MANAGE_SUPPORT_MAILBOX	undocumented
DELETE	/api/support/mailboxes/{id}	worker	API_ACCESS; handler checks MANAGE_SUPPORT_MAILBOX	undocumented
GET	/api/support/mailboxes/{id}/access	worker	API_ACCESS; handler checks MANAGE_SUPPORT_MAILBOX	undocumented
POST	/api/support/mailboxes/{id}/access	worker	API_ACCESS; handler checks MANAGE_SUPPORT_MAILBOX	undocumented
DELETE	/api/support/mailboxes/{id}/access/{accessId}	worker	API_ACCESS; handler checks MANAGE_SUPPORT_MAILBOX	undocumented
GET	/api/support/mailboxes/{id}/auto-reply-report	worker	API_ACCESS; handler checks MANAGE_SUPPORT_MAILBOX	undocumented
GET	/api/support/mailboxes/{id}/escalation-contacts	worker	API_ACCESS; handler checks MANAGE_SUPPORT_MAILBOX	undocumented
POST	/api/support/mailboxes/{id}/escalation-contacts	worker	API_ACCESS; handler checks MANAGE_SUPPORT_MAILBOX	undocumented
DELETE	/api/support/mailboxes/{id}/escalation-contacts/{contactId}	worker	API_ACCESS; handler checks MANAGE_SUPPORT_MAILBOX	undocumented
POST	/api/support/mailboxes/{id}/rotate-secret	worker	API_ACCESS; handler checks MANAGE_SUPPORT_MAILBOX	undocumented
GET	/api/support/messages/{messageId}/attachments/{attachmentId}	worker	API_ACCESS	undocumented
GET	/api/support/my-mailboxes	worker	API_ACCESS	undocumented
GET	/api/support/threads	worker	API_ACCESS	undocumented
GET	/api/support/threads/summary	worker	API_ACCESS	undocumented
GET	/api/support/threads/{threadId}	worker	API_ACCESS	undocumented
POST	/api/support/threads/{threadId}/assign	worker	API_ACCESS	undocumented
POST	/api/support/threads/{threadId}/claim	worker	API_ACCESS	undocumented
POST	/api/support/threads/{threadId}/reply	worker	API_ACCESS	undocumented
POST	/api/support/threads/{threadId}/status	worker	API_ACCESS	undocumented
GET	/api/svix/portal	worker	API_ACCESS	api/webhooks
GET	/api/telehealth/appointments	worker	API_ACCESS	undocumented
POST	/api/telehealth/appointments	worker	API_ACCESS	undocumented
POST	/api/telehealth/appointments/{id}/cancel	worker	API_ACCESS	undocumented
POST	/api/telehealth/appointments/{id}/complete	worker	API_ACCESS	undocumented
POST	/api/telehealth/appointments/{id}/video-token	worker	API_ACCESS	undocumented
GET	/api/telehealth/archives	worker	API_ACCESS	undocumented
POST	/api/telehealth/archives	worker	API_ACCESS	undocumented
GET	/api/telehealth/archives/{id}	worker	API_ACCESS	undocumented
POST	/api/telehealth/archives/{id}/legal-hold	worker	API_ACCESS; handler checks MANAGE_DATA	undocumented
GET	/api/telehealth/availability/me	worker	API_ACCESS	undocumented
PUT	/api/telehealth/availability/me	worker	API_ACCESS	undocumented
POST	/api/telehealth/conversations/{id}/video-token	worker	API_ACCESS	undocumented
GET	/api/telehealth/providers	worker	API_ACCESS	undocumented
GET	/api/telehealth/retention-settings	worker	API_ACCESS	undocumented
PUT	/api/telehealth/retention-settings	worker	API_ACCESS; handler checks MANAGE_DATA	undocumented
POST	/api/telehealth/sessions/{id}/consent	worker	API_ACCESS	undocumented
GET	/api/telehealth/slots	worker	API_ACCESS	undocumented
GET	/api/telehealth/visits/{token}	worker	none (unauthenticated)	undocumented
POST	/api/telehealth/webhooks/livekit	worker	none (unauthenticated)	undocumented
POST	/api/tenants/{id}/admin-invite	worker	API_ACCESS + MANAGE_TENANTS	platform/tenants
POST	/api/tenants/{id}/bootstrap-token	worker	API_ACCESS + MANAGE_TENANTS	platform/tenants
GET	/api/track/click	worker	none (unauthenticated)	platform/messaging
GET	/api/track/email-unsubscribe	worker	none (unauthenticated)	platform/messaging
POST	/api/track/email-unsubscribe	worker	none (unauthenticated)	platform/messaging
GET	/api/track/open	worker	none (unauthenticated)	platform/messaging
GET	/api/track/unsubscribe	worker	none (unauthenticated)	platform/messaging
POST	/api/track/unsubscribe	worker	none (unauthenticated)	platform/messaging
GET	/api/ui-menus/{name}/tree	worker	none (public read); handler checks CUSTOMIZE_APPLICATION	console/apps-and-menus
PUT	/api/ui-menus/{name}/tree	worker	API_ACCESS + ui-menus grant or CUSTOMIZE_APPLICATION	console/apps-and-menus
POST	/api/ui-pages/validate	worker	API_ACCESS + ui-pages grant or CUSTOMIZE_APPLICATION	reference/ui-pages
GET	/api/watches	worker	API_ACCESS; handler checks MANAGE_DATA / VIEW_ALL_DATA	undocumented
POST	/api/watches	worker	API_ACCESS	undocumented
GET	/api/watches/{id}	worker	API_ACCESS	undocumented
PATCH	/api/watches/{id}	worker	API_ACCESS	undocumented
DELETE	/api/watches/{id}	worker	API_ACCESS	undocumented
GET	/api/watches/{id}/alerts	worker	API_ACCESS	undocumented
POST	/api/webhooks/mail/{mailboxKey}	worker	none (unauthenticated)	undocumented
POST	/api/webhooks/ses	worker	none (unauthenticated)	platform/messaging
GET	/api/webhooks/{flowId}	worker	none (unauthenticated)	automation/triggers
POST	/api/webhooks/{flowId}	worker	none (unauthenticated)	automation/triggers
GET	/api/wins	worker	API_ACCESS; handler checks MANAGE_DATA / VIEW_ALL_DATA	undocumented
POST	/api/wins	worker	API_ACCESS	undocumented
GET	/api/wins/recent	worker	API_ACCESS	undocumented
GET	/api/wins/stats	worker	API_ACCESS	undocumented
GET	/api/wins/{id}	worker	API_ACCESS	undocumented
GET	/api/{collectionName}	worker	API_ACCESS + collection grant	reference/jsonapi
POST	/api/{collectionName}	worker	API_ACCESS + collection grant	reference/jsonapi
GET	/api/{collectionName}/aggregate	worker	API_ACCESS + collection grant	api/querying
GET	/api/{collectionName}/download/{keyTenant}/{keyCollection}/{objectId}/{fileName}	worker	API_ACCESS + collection grant	data-model/search-and-attachments
GET	/api/{collectionName}/latest	worker	API_ACCESS + collection grant	api/querying
POST	/api/{collectionName}/upload-url	worker	API_ACCESS + collection grant	data-model/search-and-attachments
GET	/api/{collectionName}/{id}	worker	API_ACCESS + collection grant	reference/jsonapi
PUT	/api/{collectionName}/{id}	worker	API_ACCESS + collection grant	reference/jsonapi
PATCH	/api/{collectionName}/{id}	worker	API_ACCESS + collection grant	reference/jsonapi
DELETE	/api/{collectionName}/{id}	worker	API_ACCESS + collection grant	reference/jsonapi
GET	/api/{collection}/_changes	worker	API_ACCESS + collection grant	api/querying
POST	/api/{collection}/semantic-search	worker	API_ACCESS + collection grant	data-model/search-and-attachments
GET	/api/{parentName}/{parentId}/{childName}	worker	API_ACCESS + collection grant	data-model/relationships
POST	/api/{parentName}/{parentId}/{childName}	worker	API_ACCESS + collection grant	data-model/relationships
GET	/api/{parentName}/{parentId}/{childName}/{childId}	worker	API_ACCESS + collection grant	data-model/relationships
PUT	/api/{parentName}/{parentId}/{childName}/{childId}	worker	API_ACCESS + collection grant	data-model/relationships
PATCH	/api/{parentName}/{parentId}/{childName}/{childId}	worker	API_ACCESS + collection grant	data-model/relationships
DELETE	/api/{parentName}/{parentId}/{childName}/{childId}	worker	API_ACCESS + collection grant	data-model/relationships
POST	/auth/direct-login	auth	none (permitAll)	security/authentication
POST	/auth/email/send-verification	auth	kelta-auth session	security/authentication
GET	/auth/email/verify	auth	kelta-auth session	security/authentication
POST	/auth/password/change	auth	kelta-auth session	security/authentication
POST	/auth/password/reset	auth	none (permitAll)	security/authentication
POST	/auth/password/reset-request	auth	none (permitAll)	security/authentication
POST	/auth/session	auth	none (permitAll)	security/authentication
DELETE	/auth/session	auth	none (permitAll)	security/authentication
POST	/auth/sms/send	auth	kelta-auth session	security/authentication
POST	/auth/sms/verify	auth	kelta-auth session	security/authentication
GET	/change-password	auth	none (permitAll)	security/authentication
POST	/change-password	auth	none (permitAll)	security/authentication
ANY	/error	auth	none (permitAll)	internal — Spring’s error page: the auth server forwards here to render a failed request; nothing calls it directly.
GET	/forgot-password	auth	none (permitAll)	security/authentication
POST	/forgot-password	auth	none (permitAll)	security/authentication
POST	/internal/tenants/{tenantId}/users/{userId}/revoke-sessions	auth	none (permitAll)	internal — Called by kelta-worker after an admin password reset, deactivation or removal; authenticated by the shared internal service token.
GET	/login	auth	none (permitAll)	security/authentication
GET	/logout/saml2/initiate	auth	none (permitAll)	security/authentication
GET	/mfa-challenge	auth	none (permitAll)	security/authentication
POST	/mfa-challenge	auth	none (permitAll)	security/authentication
POST	/mfa-challenge/recovery	auth	none (permitAll)	security/authentication
GET	/mfa-setup	auth	none (permitAll)	security/authentication
POST	/mfa-setup	auth	none (permitAll)	security/authentication
POST	/mfa-setup/complete	auth	none (permitAll)	security/authentication
GET	/oauth2/consent	auth	kelta-auth session	security/authentication
GET	/portal/api/challenge	auth	none (permitAll)	security/authentication
POST	/portal/api/login/request	auth	none (permitAll)	security/authentication
POST	/portal/api/login/verify	auth	none (permitAll)	security/authentication
POST	/portal/api/signup	auth	none (permitAll)	security/authentication
GET	/portal/login	auth	none (permitAll)	security/authentication
POST	/portal/login/request	auth	none (permitAll)	security/authentication
GET	/portal/login/verify	auth	none (permitAll)	security/authentication
GET	/reset-password	auth	none (permitAll)	security/authentication
POST	/reset-password	auth	none (permitAll)	security/authentication
GET	/scim/v2/Groups	worker	none (unauthenticated)	security/scim
POST	/scim/v2/Groups	worker	none (unauthenticated)	security/scim
GET	/scim/v2/Groups/{id}	worker	none (unauthenticated)	security/scim
PUT	/scim/v2/Groups/{id}	worker	none (unauthenticated)	security/scim
PATCH	/scim/v2/Groups/{id}	worker	none (unauthenticated)	security/scim
DELETE	/scim/v2/Groups/{id}	worker	none (unauthenticated)	security/scim
GET	/scim/v2/ResourceTypes	worker	none (unauthenticated)	security/scim
GET	/scim/v2/Schemas	worker	none (unauthenticated)	security/scim
GET	/scim/v2/ServiceProviderConfig	worker	none (unauthenticated)	security/scim
GET	/scim/v2/Users	worker	none (unauthenticated)	security/scim
POST	/scim/v2/Users	worker	none (unauthenticated)	security/scim
GET	/scim/v2/Users/{id}	worker	none (unauthenticated)	security/scim
PUT	/scim/v2/Users/{id}	worker	none (unauthenticated)	security/scim
PATCH	/scim/v2/Users/{id}	worker	none (unauthenticated)	security/scim
DELETE	/scim/v2/Users/{id}	worker	none (unauthenticated)	security/scim
GET	/{tenantSlug}/mcp/{profile}	mcp	PAT (tools re-authorized by the gateway)	mcp/overview
POST	/{tenantSlug}/mcp/{profile}	mcp	PAT (tools re-authorized by the gateway)	mcp/overview
DELETE	/{tenantSlug}/mcp/{profile}	mcp	PAT (tools re-authorized by the gateway)	mcp/overview

Not routed#

22 worker mappings are reached by no gateway route and are not public.