curl --request GET \
--url https://api.example.com/api/auth/routes \
--header 'x-api-key: <api-key>'import requests
url = "https://api.example.com/api/auth/routes"
headers = {"x-api-key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'x-api-key': '<api-key>'}};
fetch('https://api.example.com/api/auth/routes', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/auth/routes",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/auth/routes"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("x-api-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.example.com/api/auth/routes")
.header("x-api-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/auth/routes")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"data": [
{
"action": "read",
"declared_public": true,
"mapped": "<string>",
"methods": [
"<string>"
],
"path": "<string>",
"role_reach": "level",
"summary": "<string>",
"tags": [
"<string>"
]
}
]
}{
"error": "<string>",
"code": "<string>"
}List the app's HTTP routes and their scope mappings
Enumerate the app’s own HTTP routes with each route’s current scope mapping.
Covers the mapper’s route picker and its “unassigned routes” bucket (the mapped: null
entries).
routes is the app’s live route table (the route-adapter extractor hands the
operation request.app.routes so it stays request-free). One entry per
:class:starlette.routing.Route, sorted by path. Mount entries (the sub-MCP
mount, the MCP mount) are EXCLUDED — a mount is not a bindable url and the sub-MCP
surface has its own door. The exclusion is an explicit isinstance filter: any
route-table entry that is neither a Route nor a Mount raises loudly (a new
Starlette routing type must be classified here, never silently dropped). methods
is the route’s method set sorted with HEAD removed (Starlette auto-adds it to
every GET route — noise for the mapper). mapped is the url’s value from
get_all_route_mappings looked up by the EXACT path string — a scope id, the
public marker for a public pin, or null when the path has no mapping. Exact-key
lookup only: this door does not attempt dynamic-pattern matching.
declared_public is True for a route public by its own declaration: it answers
everyone whatever scope it is mapped to (the access check’s declared-public tier), so the
scope writer refuses to map it.
Each entry is JOINED with its :class:RouteMetadata (from
route_registry.load_all_routes(), a separate collection) to also carry the
route’s feature tags + summary + authorization action — the data the
Studio Roles page groups the per-tag tri-state by and marks the fenced/secret
(admin-only) routes it must never offer a grant for. The join is keyed on the route
TEMPLATE + its method set with HEAD stripped on BOTH sides (Starlette auto-adds
HEAD to a GET), so the two collections compare like-for-like; a registered route
whose method set fails to join is a loud STOP (a normalization drift), never a
silently dropped row.
curl --request GET \
--url https://api.example.com/api/auth/routes \
--header 'x-api-key: <api-key>'import requests
url = "https://api.example.com/api/auth/routes"
headers = {"x-api-key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'x-api-key': '<api-key>'}};
fetch('https://api.example.com/api/auth/routes', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/auth/routes",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/auth/routes"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("x-api-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.example.com/api/auth/routes")
.header("x-api-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/auth/routes")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"data": [
{
"action": "read",
"declared_public": true,
"mapped": "<string>",
"methods": [
"<string>"
],
"path": "<string>",
"role_reach": "level",
"summary": "<string>",
"tags": [
"<string>"
]
}
]
}{
"error": "<string>",
"code": "<string>"
}
