142 routeson the control plane · :3717
137 routeson the data plane · :3718 · a strict subset
5 gate kindspublic · service token · session · OAuth bearer · signature
Routes
| module | routes | planes | gate | what it is |
|---|---|---|---|---|
| auth-routes | 27 | both | public pages · session cookie · service token (admin) | C10 hosted identity: login, signup, verify, reset, Google, 2FA, refresh, admin identities |
| mcp-routes | 16 | both | OAuth 2.1 bearer (/mcp) · service token (management) | C23 MCP host: JSON-RPC, SSE stream, tools, instructions, consents, clients |
| membership-routes | 17 | both | none (app-asserted) · service token (teardown) | C31 roles, groups, members, invitations |
| billing-routes | 16 | both | session or service token + subscriber · Stripe signature (hook) | C33 subscription, entitlements, catalog, checkout, portal, admin |
| connect-routes | 11 | both | session · session or service token + owner | C24 connectors: start, callback, token, calendar write, send |
| oauth-routes | 8 | both | public (DCR, token) · session (authorize) · service token (admin token) | C23 OAuth 2.1 authorization server |
| authz-routes | 7 | both | none (app-asserted) | C29 authorize, policies, approvals |
| notifications-routes | 7 | both | none · public (VAPID key) | C4 notifications · C21 push subscriptions |
| blobs-routes · search-routes · incident-routes | 4 · 4 · 4 | both | none (owner-filtered) | C20 blobs · C19 search · C15 incidents |
| app-events-routes | 3 | both | none (app-asserted owner) | C3 emit, query, latest |
| status · tenant · theme · owner | 2 · 1 · 1 · 1 | both | public · service token · public · none | C15 status page · C34 teardown · C16 theme.css · C11 claim-legacy |
| sms-routes · ingest-routes | 3 · 1 | control only | none · Google OIDC service identity | C21 phone verification + Twilio hook · eval-runner ingest |
Discovery, without a token
| GET | answers |
|---|---|
| /health · /health/deep | liveness · readiness with billing-mode consistency |
| /capabilities | the capability list this plane serves |
| /.well-known/oauth-protected-resource[/mcp] · /.well-known/oauth-authorization-server[/mcp] | RFC 9728 · RFC 8414 — the path-suffixed forms exist because Claude's validator requires them |
| /status · /status.json · /theme.css · /auth/config · /connect/providers · /billing/catalog | public health page · tokens · enabled sign-in methods · configured providers · plans |
The same-origin proxy contract
Only /auth/* is a generated rewrite. /oauth/*, /mcp, /connect/*, /billing/* + the Stripe hook (raw body), /status and /theme.css are a documented contract your app adds itself.