Every table below is generated from the decorators in
apps/server/controllers/*.controller.ts: the backend's npm run docs:routes writes
docs/admin-routes.md, and this repo's npm run docs:sync splices that file between
the markers below. apps/server/tests/route-manifest.unit.test.ts fails the backend
build when the committed table no longer matches the code. Base paths declared as constants — the
HTTP_ROUTES.* ones behind /rest/v1, /api/edge, /api/files and
/realtime/v1/api/broadcast — are resolved, so every path here is one you can call.
Routes are mounted automatically by awilix-express's loadControllers, so this is the
whole controller surface. Auth routes (/api/auth/*) are owned by Better Auth and are not
in this table — see Auth. A handful of endpoints are mounted
directly in app.ts and are listed under Outside the controllers.
Guards are the @before(...) chain, in order. adminOnly means adminGuard: a valid X-Platform-Token, or a session whose role is ADMIN. See request lifecycle.
Every response uses the shared envelope from helpers/api-response.helper.ts; errors use the shape described in the error reference.
AI assistant
Source: apps/server/controllers/ai.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
POST | /api/admin/ai/chat | chat | adminOnly |
POST | /api/admin/ai/models | models | adminOnly |
GET | /api/admin/ai/providers | providers | adminOnly |
POST | /api/admin/ai/test | test | adminOnly |
GET | /api/admin/ai/threads | listThreads | adminOnly |
GET | /api/admin/ai/threads/:id | getThread | adminOnly |
PATCH | /api/admin/ai/threads/:id | rename | adminOnly |
DELETE | /api/admin/ai/threads/:id | remove | adminOnly |
POST | /api/admin/ai/threads/:id/resolve | resolve | adminOnly |
Auth admin: user administration by secret key
Source: apps/server/controllers/auth-admin.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
POST | /api/auth/admin/generate-link | generateLink | secretKeyOnly |
POST | /api/auth/admin/invite | inviteUserByEmail | secretKeyOnly |
GET | /api/auth/admin/users | listUsers | secretKeyOnly |
POST | /api/auth/admin/users | createUser | secretKeyOnly |
GET | /api/auth/admin/users/:id | getUserById | secretKeyOnly |
PATCH | /api/auth/admin/users/:id | updateUserById | secretKeyOnly |
DELETE | /api/auth/admin/users/:id | deleteUser | secretKeyOnly |
GET | /api/auth/admin/users/:id/factors | listFactors | secretKeyOnly |
DELETE | /api/auth/admin/users/:id/factors/:factorId | deleteFactor | secretKeyOnly |
POST | /api/auth/admin/users/:id/sign-out | signOutUser | secretKeyOnly |
Auth: the project audit trail
Source: apps/server/controllers/admin-auth.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
GET | /api/admin/auth/audit-logs | auditLogs | adminOnly |
Content: SQL snippets, saved log queries, reports
Source: apps/server/controllers/admin-content.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
GET | /api/admin/content | listContent | adminOnly |
POST | /api/admin/content | createContent | adminOnly |
GET | /api/admin/content-folders | listFolders | adminOnly |
POST | /api/admin/content-folders | createFolder | adminOnly |
PATCH | /api/admin/content-folders/:id | renameFolder | adminOnly |
DELETE | /api/admin/content-folders/:id | deleteFolder | adminOnly |
GET | /api/admin/content/:id | getContent | adminOnly |
PATCH | /api/admin/content/:id | updateContent | adminOnly |
DELETE | /api/admin/content/:id | deleteContent | adminOnly |
Core: tables, dashboard, project info
Source: apps/server/controllers/admin-core.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
GET | /api/admin/connect-info | connectInfo | adminOnly |
GET | /api/admin/session | session | adminOnly |
POST | /api/admin/sql | sql | adminOnly |
POST | /api/admin/sql/readonly | sqlReadonly | adminOnly |
GET | /api/admin/tables | tables | adminOnly |
Database workflow: migration history, push, diff, dump, seed, reset, tests
Source: apps/server/controllers/admin-db.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
POST | /api/admin/db/diff | diffSchema | adminOnly |
POST | /api/admin/db/dump | dumpDatabase | adminOnly |
GET | /api/admin/db/migrations | migrationHistory | adminOnly |
POST | /api/admin/db/migrations | pushMigration | adminOnly |
POST | /api/admin/db/migrations/:version/repair | repairMigration | adminOnly |
POST | /api/admin/db/reset | resetDatabase | adminOnly |
POST | /api/admin/db/seed | seedDatabase | adminOnly |
POST | /api/admin/db/test | testDatabase | adminOnly |
Database: indexes, enums, roles, privileges, publications, settings
Source: apps/server/controllers/admin-database.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
GET | /api/admin/database/column-privileges | columnPrivileges | adminOnly |
PUT | /api/admin/database/column-privileges | setColumnPrivilege | adminOnly |
GET | /api/admin/database/config | postgresConfig | adminOnly |
PATCH | /api/admin/database/config | updatePostgresConfig | adminOnly |
GET | /api/admin/database/publications | listPublications | adminOnly |
POST | /api/admin/database/publications | createPublication | adminOnly |
PATCH | /api/admin/database/publications/:name | updatePublication | adminOnly |
DELETE | /api/admin/database/publications/:name | dropPublication | adminOnly |
GET | /api/admin/database/roles | listRoles | adminOnly |
POST | /api/admin/database/roles | createRole | adminOnly |
PATCH | /api/admin/database/roles/:name | updateRole | adminOnly |
DELETE | /api/admin/database/roles/:name | dropRole | adminOnly |
GET | /api/admin/schema/enums | listEnums | adminOnly |
POST | /api/admin/schema/enums | createEnum | adminOnly |
PATCH | /api/admin/schema/enums/:name | alterEnum | adminOnly |
DELETE | /api/admin/schema/enums/:name | dropEnum | adminOnly |
GET | /api/admin/schema/indexes | schemaIndexes | adminOnly |
GET | /api/admin/schema/table-stats | tableStats | adminOnly |
Devices: push registration
Source: apps/server/controllers/device.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
POST | /api/devices | register | authMiddleware, registerDeviceValidator, validateRequest |
DELETE | /api/devices | unregister | authMiddleware, unregisterDeviceValidator, validateRequest |
Edge functions: invocation
Source: apps/server/controllers/edge-invoke.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
GET | /api/edge/:route | invokeByRoute | optionalAuthMiddleware, edgeInvokeLimiter, edgeInvokeGuard |
POST | /api/edge/:route | invokeByRoute | optionalAuthMiddleware, edgeInvokeLimiter, edgeInvokeGuard |
PUT | /api/edge/:route | invokeByRoute | optionalAuthMiddleware, edgeInvokeLimiter, edgeInvokeGuard |
PATCH | /api/edge/:route | invokeByRoute | optionalAuthMiddleware, edgeInvokeLimiter, edgeInvokeGuard |
DELETE | /api/edge/:route | invokeByRoute | optionalAuthMiddleware, edgeInvokeLimiter, edgeInvokeGuard |
Edge functions: management
Source: apps/server/controllers/edge-function.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
GET | /api/admin/edge-functions | list | adminOnly |
POST | /api/admin/edge-functions | create | adminOnly |
GET | /api/admin/edge-functions/:id | get | adminOnly |
PATCH | /api/admin/edge-functions/:id | update | adminOnly |
DELETE | /api/admin/edge-functions/:id | delete | adminOnly |
POST | /api/admin/edge-functions/:id/invoke | invoke | adminOnly |
GET | /api/admin/edge-functions/:id/logs | logs | adminOnly |
Files: authenticated storage API
Source: apps/server/controllers/file.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
POST | /api/files | upload | ...storageAuth, streamUpload.single('file') |
DELETE | /api/files/:id | remove | storageAuth |
POST | /api/files/:id/finalize | finalize | storageIdentity |
GET | /api/files/:id/raw | raw | storageAuth |
GET | /api/files/:id/url | getUrl | storageAuth |
POST | /api/files/copy | copyObject | storageAuth |
GET | /api/files/list/:bucket | listObjects | storageAuth |
POST | /api/files/move | moveObject | storageAuth |
GET | /api/files/object-info/:bucket/* | infoByKey | storageAuth |
GET | /api/files/object-url/:bucket/* | urlByKey | storageAuth |
GET | /api/files/object/:bucket/* | rawByKey | storageAuth |
DELETE | /api/files/object/:bucket/* | removeByKey | storageAuth |
POST | /api/files/presign | presign | storageAuth |
Git: inbound webhook
Source: apps/server/controllers/git-webhook.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
POST | /api/git/webhook | webhook | — |
Git: repository link and migration sync
Source: apps/server/controllers/admin-git.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
GET | /api/admin/git/authorize | gitAuthorize | adminOnly |
POST | /api/admin/git/callback | gitCallback | adminOnly |
POST | /api/admin/git/link | gitLink | adminOnly |
DELETE | /api/admin/git/link | gitUnlink | adminOnly |
GET | /api/admin/git/repos | gitRepos | adminOnly |
GET | /api/admin/git/status | gitStatus | adminOnly |
POST | /api/admin/git/sync | gitSync | adminOnly |
Infrastructure: JWT signing keys, network access, log drains
Source: apps/server/controllers/admin-infrastructure.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
GET | /api/admin/auth/signing-keys | signingKeys | adminOnly |
POST | /api/admin/auth/signing-keys | createSigningKey | adminOnly |
DELETE | /api/admin/auth/signing-keys/:id | deleteSigningKey | adminOnly |
POST | /api/admin/auth/signing-keys/:id/revoke | revokeSigningKey | adminOnly |
POST | /api/admin/auth/signing-keys/:id/rotate | rotateSigningKey | adminOnly |
GET | /api/admin/log-drains | logDrains | adminOnly |
POST | /api/admin/log-drains | createLogDrain | adminOnly |
PATCH | /api/admin/log-drains/:id | updateLogDrain | adminOnly |
DELETE | /api/admin/log-drains/:id | deleteLogDrain | adminOnly |
POST | /api/admin/log-drains/:id/test | testLogDrain | adminOnly |
GET | /api/admin/network-restrictions | networkRestrictions | adminOnly |
PUT | /api/admin/network-restrictions | updateNetworkRestrictions | adminOnly |
GET | /api/admin/ssl-enforcement | sslEnforcement | adminOnly |
PUT | /api/admin/ssl-enforcement | updateSslEnforcement | adminOnly |
Integrations
Source: apps/server/controllers/integrations.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
GET | /api/admin/integrations | list | adminOnly |
DELETE | /api/admin/integrations/:key | disconnect | adminOnly |
POST | /api/admin/integrations/:key/connect | connect | adminOnly |
jwks.controller.ts
Source: apps/server/controllers/jwks.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
GET | /auth/v1/.well-known/jwks.json | jwks | — |
Notifications
Source: apps/server/controllers/notification.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
POST | /api/notifications/send | send | authMiddleware, requireRole(UserRole.ADMIN), sendNotificationValidator, validateRequest |
POST | /api/notifications/test | test | authMiddleware, testNotificationValidator, validateRequest |
Observability: logs, metrics, advisors, jobs
Source: apps/server/controllers/admin-observability.controller.ts
GET /api/admin/logs accepts limit (default 500, capped at 5000), since
(ISO timestamp or epoch ms), level, source (repeated or comma-separated) and
q. It answers from platform.request_logs when log storage is on
(logs.retention), and from the in-memory ring buffer otherwise; the response
carries persisted, retentionDays and oldestAvailable alongside logs.
| Method | Path | Handler | Guards |
|---|---|---|---|
GET | /api/admin/backups | backups | adminOnly |
POST | /api/admin/backups | createBackup | adminOnly |
POST | /api/admin/backups/clone-staging | cloneStaging | adminOnly |
GET | /api/admin/backups/config | backupConfig | adminOnly |
PUT | /api/admin/backups/config | updateBackupConfig | adminOnly |
GET | /api/admin/backups/download | downloadBackup | adminOnly |
POST | /api/admin/backups/export | exportProject | adminOnly |
POST | /api/admin/backups/export-full | exportFullProject | adminOnly |
POST | /api/admin/backups/extract | extractBackupArchive | adminOnly |
GET | /api/admin/backups/list | backupsList | adminOnly |
POST | /api/admin/backups/restore | restoreBackup | adminOnly |
POST | /api/admin/backups/run | runBackup | adminOnly |
POST | /api/admin/backups/upload | uploadBackupFile | adminBackupUpload |
GET | /api/admin/logs | logs | apiKeyMiddleware, secretKeyOrAdmin |
GET | /api/admin/metrics/requests | requestMetrics | adminOnly |
GET | /api/admin/metrics/timeseries | metricsTimeseries | adminOnly |
GET | /api/admin/performance | performance | adminOnly |
GET | /api/admin/performance/index-advisor | indexAdvisorStatus | adminOnly |
POST | /api/admin/performance/index-advisor | adviseIndexes | adminOnly |
POST | /api/admin/performance/index-advisor/enable | enableIndexAdvisor | adminOnly |
GET | /api/admin/realtime/channels | realtimeChannels | adminOnly |
GET | /api/admin/realtime/channels/:channel/presence | realtimePresence | adminOnly |
GET | /api/admin/realtime/config | realtimeConfig | adminOnly |
PATCH | /api/admin/realtime/config | updateRealtimeConfig | adminOnly |
PATCH | /api/admin/realtime/config/respect-rls | updateRealtimeRespectRls | adminOnly |
GET | /api/admin/realtime/events | realtimeEvents | adminOnly |
GET | /api/admin/realtime/queue | realtimeQueue | adminOnly |
GET | /api/admin/stats | stats | adminOnly |
Operations: backups, imports, cron, retention
Source: apps/server/controllers/admin-operations.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
GET | /api/admin/cron/app/jobs | listAppCronJobs | adminOnly |
GET | /api/admin/cron/pg/jobs | listPgCronJobs | adminOnly |
POST | /api/admin/cron/pg/jobs | createPgCronJob | adminOnly |
PATCH | /api/admin/cron/pg/jobs/:id | togglePgCronJob | adminOnly |
DELETE | /api/admin/cron/pg/jobs/:id | deletePgCronJob | adminOnly |
GET | /api/admin/cron/pg/jobs/:id/runs | pgCronJobRuns | adminOnly |
POST | /api/admin/import/supabase | importSupabase | adminOnly |
PATCH | /api/admin/jobs/:id | configureJob | adminOnly |
POST | /api/admin/jobs/:id/run | runJobNow | adminOnly |
GET | /api/admin/jobs/alerts | listJobAlerts | adminOnly |
GET | /api/admin/jobs/runs | listJobRuns | adminOnly |
GET | /api/admin/migrations | listMigrations | adminOnly |
POST | /api/admin/migrations | createMigration | adminOnly |
GET | /api/admin/migrations/:id | getMigration | adminOnly |
POST | /api/admin/migrations/:id/apply | applyMigration | adminOnly |
POST | /api/admin/migrations/:id/rollback | rollbackMigration | adminOnly |
GET | /api/admin/migrations/diff | migrationsDiff | adminOnly |
Queues: pgmq queues, messages and API exposure
Source: apps/server/controllers/admin-queues.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
GET | /api/admin/queues | listQueues | adminOnly |
POST | /api/admin/queues | createQueue | adminOnly |
DELETE | /api/admin/queues/:name | dropQueue | adminOnly |
GET | /api/admin/queues/:name/messages | browseMessages | adminOnly |
POST | /api/admin/queues/:name/messages | sendMessage | adminOnly |
DELETE | /api/admin/queues/:name/messages/:msgId | deleteMessage | adminOnly |
POST | /api/admin/queues/:name/messages/:msgId/archive | archiveMessage | adminOnly |
GET | /api/admin/queues/:name/permissions | queuePermissions | adminOnly |
PUT | /api/admin/queues/:name/permissions | setQueuePermissions | adminOnly |
POST | /api/admin/queues/:name/purge | purgeQueue | adminOnly |
POST | /api/admin/queues/:name/read | readMessages | adminOnly |
POST | /api/admin/queues/enable | enableQueues | adminOnly |
PUT | /api/admin/queues/expose | exposeQueues | adminOnly |
Realtime: broadcast
Source: apps/server/controllers/realtime-broadcast.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
POST | /realtime/v1/api/broadcast | broadcast | optionalAuthMiddleware, apiKeyMiddleware |
REST: auto-generated table API
Source: apps/server/controllers/rest-api.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
GET | /rest/v1/:model | get | optionalAuthMiddleware, apiKeyMiddleware, restApiLimiter |
HEAD | /rest/v1/:model | head | optionalAuthMiddleware, apiKeyMiddleware, restApiLimiter |
POST | /rest/v1/:model | post | optionalAuthMiddleware, apiKeyMiddleware, restApiLimiter |
PATCH | /rest/v1/:model | patch | optionalAuthMiddleware, apiKeyMiddleware, restApiLimiter |
DELETE | /rest/v1/:model | delete | optionalAuthMiddleware, apiKeyMiddleware, restApiLimiter |
POST | /rest/v1/batch | batch | optionalAuthMiddleware, apiKeyMiddleware, restApiLimiter |
GET | /rest/v1/rpc/:fn | rpcGet | optionalAuthMiddleware, apiKeyMiddleware, restApiLimiter |
POST | /rest/v1/rpc/:fn | rpcPost | optionalAuthMiddleware, apiKeyMiddleware, restApiLimiter |
Rows: table editor CRUD
Source: apps/server/controllers/admin-rows.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
GET | /api/admin/tables/:model/rows | rows | adminOnly |
POST | /api/admin/tables/:model/rows | createRow | adminOnly |
PATCH | /api/admin/tables/:model/rows/:id | updateRow | adminOnly |
DELETE | /api/admin/tables/:model/rows/:id | deleteRow | adminOnly |
Schema: SQL, DDL, migrations, triggers
Source: apps/server/controllers/admin-schema.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
GET | /api/admin/rest/resources | listRestResources | adminOnly |
GET | /api/admin/schema/extensions | listExtensions | adminOnly |
POST | /api/admin/schema/extensions/:name | enableExtension | adminOnly |
DELETE | /api/admin/schema/extensions/:name | disableExtension | adminOnly |
GET | /api/admin/schema/functions | listFunctions | adminOnly |
POST | /api/admin/schema/functions | createFunction | adminOnly |
DELETE | /api/admin/schema/functions/:signature | dropFunction | adminOnly |
GET | /api/admin/schema/graph | schemaGraph | adminOnly |
DELETE | /api/admin/schema/indexes/:name | dropIndex | adminOnly |
GET | /api/admin/schema/schemas | schemaList | adminOnly |
GET | /api/admin/schema/tables | schemaTables | adminOnly |
POST | /api/admin/schema/tables | createTable | adminOnly |
DELETE | /api/admin/schema/tables/:table | dropTable | adminOnly |
POST | /api/admin/schema/tables/:table/columns | addColumn | adminOnly |
DELETE | /api/admin/schema/tables/:table/columns/:column | dropColumn | adminOnly |
PATCH | /api/admin/schema/tables/:table/columns/:column/default | setColumnDefault | adminOnly |
PATCH | /api/admin/schema/tables/:table/columns/:column/nullable | setColumnNullable | adminOnly |
PATCH | /api/admin/schema/tables/:table/columns/:column/rename | renameColumn | adminOnly |
GET | /api/admin/schema/tables/:table/indexes | listIndexes | adminOnly |
POST | /api/admin/schema/tables/:table/indexes | createIndex | adminOnly |
GET | /api/admin/schema/trigger-functions | listTriggerFunctions | adminOnly |
GET | /api/admin/schema/triggers | listTriggers | adminOnly |
POST | /api/admin/schema/triggers | createSchemaTrigger | adminOnly |
DELETE | /api/admin/schema/triggers/:name | dropSchemaTrigger | adminOnly |
POST | /api/admin/schema/triggers/:name/enabled | setSchemaTriggerEnabled | adminOnly |
GET | /api/admin/schema/types | schemaTypes | adminOnly |
Security: RLS, shield, rate limits
Source: apps/server/controllers/admin-security.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
GET | /api/admin/advisor | advisor | adminOnly |
GET | /api/admin/api-keys | listApiKeys | adminOnly |
POST | /api/admin/api-keys | createApiKey | adminOnly |
DELETE | /api/admin/api-keys/:id | revokeApiKey | adminOnly |
GET | /api/admin/database/connection | databaseConnection | adminOnly |
GET | /api/admin/edge-secrets | listSecrets | adminOnly |
PUT | /api/admin/edge-secrets | setSecret | adminOnly |
DELETE | /api/admin/edge-secrets/:name | deleteSecret | adminOnly |
GET | /api/admin/realtime/policies | realtimePolicies | adminOnly |
POST | /api/admin/realtime/policies | realtimeCreatePolicy | adminOnly |
DELETE | /api/admin/realtime/policies/:name | realtimeDropPolicy | adminOnly |
GET | /api/admin/rls/access | rlsAccess | adminOnly |
POST | /api/admin/rls/policies | rlsCreatePolicy | adminOnly |
PUT | /api/admin/rls/policies | rlsReplacePolicy | adminOnly |
DELETE | /api/admin/rls/policies | rlsDropPolicy | adminOnly |
POST | /api/admin/rls/simulate | rlsSimulate | adminOnly |
POST | /api/admin/rls/simulate/diff | rlsSimulateDiff | adminOnly |
GET | /api/admin/rls/tables | rlsTables | adminOnly |
POST | /api/admin/rls/tables/:table/preset | rlsApplyPreset | adminOnly |
POST | /api/admin/rls/tables/:table/rls | rlsToggle | adminOnly |
GET | /api/admin/shield | shield | adminOnly |
GET | /api/admin/storage/connection | storageConnection | adminOnly |
Settings: settings groups and secrets
Source: apps/server/controllers/admin-settings.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
GET | /api/admin/auth/status | authStatus | adminOnly |
GET | /api/admin/settings | settingsList | adminOnly |
GET | /api/admin/settings/:group | settingsGet | adminOnly |
PUT | /api/admin/settings/:group | settingsPut | adminOnly |
DELETE | /api/admin/settings/:group | settingsDelete | adminOnly |
POST | /api/admin/settings/email/test | settingsEmailTest | adminOnly |
POST | /api/admin/settings/push/test | settingsPushTest | adminOnly |
POST | /api/admin/settings/sms/test | settingsSmsTest | adminOnly |
GET | /api/admin/webhooks | webhooks | adminOnly |
POST | /api/admin/webhooks | createWebhook | adminOnly |
PATCH | /api/admin/webhooks/:id | updateWebhook | adminOnly |
DELETE | /api/admin/webhooks/:id | deleteWebhook | adminOnly |
GET | /api/admin/webhooks/:id/deliveries | webhookDeliveries | adminOnly |
POST | /api/admin/webhooks/:id/test | testWebhook | adminOnly |
GET | /api/admin/webhooks/events | listWebhookEvents | adminOnly |
storage-render.controller.ts
Source: apps/server/controllers/storage-render.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
GET | /storage/v1/render/image/authenticated/:bucket/* | renderAuthenticated | storageAuth |
GET | /storage/v1/render/image/public/:slug/* | renderPublic | — |
GET | /storage/v1/render/image/sign/:bucket/* | renderSigned | — |
Storage: bucket administration by secret key
Source: apps/server/controllers/storage-bucket.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
GET | /api/files/bucket | list | apiKeyMiddleware, requireSecretKey |
POST | /api/files/bucket | create | apiKeyMiddleware, requireSecretKey |
GET | /api/files/bucket/:slug | get | apiKeyMiddleware, requireSecretKey |
PUT | /api/files/bucket/:slug | update | apiKeyMiddleware, requireSecretKey |
DELETE | /api/files/bucket/:slug | remove | apiKeyMiddleware, requireSecretKey |
POST | /api/files/bucket/:slug/empty | empty | apiKeyMiddleware, requireSecretKey |
Storage: buckets, objects, tokens, CORS
Source: apps/server/controllers/admin-storage.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
GET | /api/admin/storage/bucket-deletions | bucketDeletions | adminOnly |
GET | /api/admin/storage/bucket-deletions/:id | bucketDeletionStatus | adminOnly |
GET | /api/admin/storage/buckets | listBuckets | adminOnly |
POST | /api/admin/storage/buckets | createBucket | adminOnly |
GET | /api/admin/storage/buckets/:slug | getBucket | adminOnly |
PATCH | /api/admin/storage/buckets/:slug | updateBucket | adminOnly |
DELETE | /api/admin/storage/buckets/:slug | deleteBucket | adminOnly |
POST | /api/admin/storage/buckets/:slug/copy | copyBucketObject | adminOnly |
GET | /api/admin/storage/buckets/:slug/cors | getBucketCors | adminOnly |
PUT | /api/admin/storage/buckets/:slug/cors | upsertBucketCors | adminOnly |
DELETE | /api/admin/storage/buckets/:slug/cors | deleteBucketCors | adminOnly |
GET | /api/admin/storage/buckets/:slug/files | bucketFiles | adminOnly |
POST | /api/admin/storage/buckets/:slug/move | moveBucketObject | adminOnly |
GET | /api/admin/storage/buckets/:slug/objects | listBucketObjects | adminOnly |
GET | /api/admin/storage/buckets/:slug/objects/* | bucketObjectRaw | adminOnly |
DELETE | /api/admin/storage/buckets/:slug/objects/* | removeBucketObject | adminOnly |
GET | /api/admin/storage/buckets/:slug/tokens | listBucketTokens | adminOnly |
POST | /api/admin/storage/buckets/:slug/tokens | createBucketToken | adminOnly |
DELETE | /api/admin/storage/buckets/:slug/tokens/:id | revokeBucketToken | adminOnly |
GET | /api/admin/storage/buckets/:slug/webhooks | listBucketWebhooks | adminOnly |
POST | /api/admin/storage/buckets/:slug/webhooks | addBucketWebhook | adminOnly |
DELETE | /api/admin/storage/buckets/:slug/webhooks/:id | removeBucketWebhook | adminOnly |
GET | /api/admin/storage/files | storageFiles | adminOnly |
POST | /api/admin/storage/files | storageUpload | adminUpload |
DELETE | /api/admin/storage/files/:id | storageDelete | adminOnly |
GET | /api/admin/storage/files/:id/raw | storageFileRaw | adminOnly |
GET | /api/admin/storage/files/:id/render | storageFileRender | adminOnly |
GET | /api/admin/storage/files/:id/url | storageFileUrl | adminOnly |
Storage: public and token API
Source: apps/server/controllers/storage-public.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
GET | /api/storage/:slug/files/:id | download | — |
DELETE | /api/storage/:slug/files/:id | remove | bucketTokenGuard('delete') |
POST | /api/storage/:slug/upload | upload | bucketTokenGuard('write'), streamUpload.single('file') |
Storage: S3 endpoint and access keys
Source: apps/server/controllers/admin-storage-s3.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
GET | /api/admin/storage/s3 | connection | adminOnly |
GET | /api/admin/storage/s3/keys | listKeys | adminOnly |
POST | /api/admin/storage/s3/keys | createKey | adminOnly |
DELETE | /api/admin/storage/s3/keys/:id | revokeKey | adminOnly |
Users: administration
Source: apps/server/controllers/admin-users.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
GET | /api/admin/users | users | adminOnly |
POST | /api/admin/users | createUser | adminOnly |
GET | /api/admin/users/:id | user | adminOnly |
PATCH | /api/admin/users/:id | updateUser | adminOnly |
DELETE | /api/admin/users/:id | deleteUser | adminOnly |
POST | /api/admin/users/:id/demote | demote | adminOnly |
POST | /api/admin/users/:id/email-verification | setEmailVerified | adminOnly |
POST | /api/admin/users/:id/impersonate | impersonate | adminOnly |
POST | /api/admin/users/:id/impersonate/stop | stopImpersonating | adminOnly |
POST | /api/admin/users/:id/promote | promote | adminOnly |
POST | /api/admin/users/:id/reset-password | resetPassword | adminOnly |
POST | /api/admin/users/:id/revoke-sessions | revokeSessions | adminOnly |
DELETE | /api/admin/users/:id/sessions/:sessionId | revokeSession | adminOnly |
GET | /api/admin/users/sessions | sessions | adminOnly |
Users: self-service
Source: apps/server/controllers/user.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
DELETE | /api/users | deleteAccount | authMiddleware |
PUT | /api/users/image | updateImage | authMiddleware, imageUpload.single('image') |
PUT | /api/users/username | updateUsername | authMiddleware, updateUsernameValidator, validateRequest |
Vault: encrypted secrets
Source: apps/server/controllers/admin-vault.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
GET | /api/admin/vault | listSecrets | adminOnly |
POST | /api/admin/vault/enable | enableVault | adminOnly |
POST | /api/admin/vault/secrets | createSecret | adminOnly |
PATCH | /api/admin/vault/secrets/:id | updateSecret | adminOnly |
DELETE | /api/admin/vault/secrets/:id | deleteSecret | adminOnly |
GET | /api/admin/vault/secrets/:id/reveal | revealSecret | adminOnly |
Wrappers: foreign data wrappers
Source: apps/server/controllers/admin-wrappers.controller.ts
| Method | Path | Handler | Guards |
|---|---|---|---|
GET | /api/admin/wrappers | listWrappers | adminOnly |
POST | /api/admin/wrappers/:wrapper/enable | enableWrapper | adminOnly |
POST | /api/admin/wrappers/servers | createForeignServer | adminOnly |
DELETE | /api/admin/wrappers/servers/:name | dropForeignServer | adminOnly |
PUT | /api/admin/wrappers/servers/:name/credentials | setForeignServerCredentials | adminOnly |
POST | /api/admin/wrappers/servers/:name/import | importForeignSchema | adminOnly |
POST | /api/admin/wrappers/tables | createForeignTable | adminOnly |
DELETE | /api/admin/wrappers/tables/:schema/:name | dropForeignTable | adminOnly |
Notes on specific surfaces
The table above is generated from the controller decorators and is spliced in by
npm run docs:sync. Anything written inside those markers is overwritten on the
next sync, so per-route commentary belongs here instead. A note that belongs to a
whole section goes in the backend's SECTION_NOTES (apps/server/lib/route-docs.ts),
which is where its heading already lives.
API keys and database connection
/api/admin/api-keys and /api/admin/database/connection are mapped to the
secrets.manage capability in the Console proxy: the first returns a freshly
minted key on create, the second returns the database password. GET /api/admin/api-keys
also mints the default publishable key on first read, so a project that predates
the feature shows a usable key rather than an empty table. See
API Keys.
/api/auth/admin/*
Guarded by secretKeyOnly: a valid secret project API key in the apikey
header, and nothing else — not an operator session, not a publishable key. This is
the client.auth.admin namespace in the SDK, and it is deliberately the only
surface a secret key opens besides the data plane. The Studio admin API above,
which runs SQL, DDL and backups, keeps its own operator authentication.
listUsers takes page and per_page, capped at 1000 rows. updateUserById
routes password and role changes to their own guarded methods rather than merging
them into one write: the profile patch refuses to write role on purpose, and
going around that would reopen the escalation path that allowlist exists to close.
invite does not echo the temporary password back — it has already gone out by
email, and returning it would put a live credential in the caller's logs.
Outside the controllers
These are mounted directly in apps/server/app.ts rather than by a controller, so they
carry no @before chain:
| Method | Path | What it is | Guards |
|---|---|---|---|
GET | / | Service descriptor: { name, docs, health } | none |
GET | /api/health-check | 200 { message, status, db: "connected" }, or 503 { …, db: "disconnected" } when SELECT 1 fails | none |
GET | /api/docs | Swagger UI over the generated OpenAPI document | none |
ALL | /api/auth/* | The whole Better Auth surface, mounted as one handler before the body parsers | authLimiter on credential endpoints, then Better Auth's own |
GET | /docs/sdk.md | The SDK reference as raw Markdown, for agents and curl | none |
GET | /console/* | 308 redirect to the same path under /studio | none |
GET | /studio/* | Project Studio, when a build is present | Studio's own session |
GET | /<public-bucket>/* | Static files for the public storage bucket, local driver only | none |
/api/health-check and /api/docs are unauthenticated by design; /api/docs describes
routes but exposes no data. Block both at the edge if you do not want them public — see
Traefik and TLS.
The Studio mount is deliberately non-fatal: if the Next build is missing or the filesystem
is read-only, the server logs [studio] mount failed, /studio disabled and keeps serving
the API. A missing Studio is never allowed to look like a network outage.
GET / answers with a small service descriptor naming the two paths a prober actually
wants, and deliberately no version:
{ "name": "Motherbase API", "docs": "/api/docs", "health": "/api/health-check" }