> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tai42.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# List the app's HTTP routes and their scope mappings

> Enumerate the app's own HTTP routes with each route's current scope mapping —
the mapper's route picker and its "unassigned routes" bucket (the ``mapped: null``
entries).

``routes`` is the app's live route table (the route-adapter extractor hands the
operation ``request.app.routes`` so it stays request-free). One entry per
:class:`starlette.routing.Route`, sorted by ``path``. ``Mount`` entries (the sub-MCP
mount, the MCP mount) are EXCLUDED — a mount is not a bindable url and the sub-MCP
surface has its own door. The exclusion is an explicit ``isinstance`` filter: any
route-table entry that is neither a ``Route`` nor a ``Mount`` raises loudly (a new
Starlette routing type must be classified here, never silently dropped). ``methods``
is the route's method set sorted with ``HEAD`` removed (Starlette auto-adds it to
every GET route — noise for the mapper). ``mapped`` is the url's value from
``get_all_route_mappings`` looked up by the EXACT path string — a scope id, the
public marker for a public pin, or ``null`` when the path has no mapping. Exact-key
lookup only: this door does not attempt dynamic-pattern matching.

Each entry is JOINED with its :class:`RouteMetadata` (from
``route_registry.load_all_routes()``, a separate collection) to also carry the
route's feature ``tags`` + ``summary`` + authorization ``action`` — the data the
Studio Roles page groups the per-tag tri-state by and marks the ``fenced``/``secret``
(admin-only) routes it must never offer a grant for. The join is keyed on the route
TEMPLATE + its method set with ``HEAD`` stripped on BOTH sides (Starlette auto-adds
``HEAD`` to a GET), so the two collections compare like-for-like; a registered route
whose method set fails to join is a loud STOP (a normalization drift), never a
silently dropped row.



## OpenAPI

````yaml /openapi.json get /api/auth/routes
openapi: 3.1.0
info:
  description: The operator HTTP surface served under /api/*.
  title: tai42-skeleton API
  version: 0.1.1
servers: []
security: []
paths:
  /api/auth/routes:
    get:
      tags:
        - access-control
      summary: List the app's HTTP routes and their scope mappings
      description: >-
        Enumerate the app's own HTTP routes with each route's current scope
        mapping —

        the mapper's route picker and its "unassigned routes" bucket (the
        ``mapped: null``

        entries).


        ``routes`` is the app's live route table (the route-adapter extractor
        hands the

        operation ``request.app.routes`` so it stays request-free). One entry
        per

        :class:`starlette.routing.Route`, sorted by ``path``. ``Mount`` entries
        (the sub-MCP

        mount, the MCP mount) are EXCLUDED — a mount is not a bindable url and
        the sub-MCP

        surface has its own door. The exclusion is an explicit ``isinstance``
        filter: any

        route-table entry that is neither a ``Route`` nor a ``Mount`` raises
        loudly (a new

        Starlette routing type must be classified here, never silently dropped).
        ``methods``

        is the route's method set sorted with ``HEAD`` removed (Starlette
        auto-adds it to

        every GET route — noise for the mapper). ``mapped`` is the url's value
        from

        ``get_all_route_mappings`` looked up by the EXACT path string — a scope
        id, the

        public marker for a public pin, or ``null`` when the path has no
        mapping. Exact-key

        lookup only: this door does not attempt dynamic-pattern matching.


        Each entry is JOINED with its :class:`RouteMetadata` (from

        ``route_registry.load_all_routes()``, a separate collection) to also
        carry the

        route's feature ``tags`` + ``summary`` + authorization ``action`` — the
        data the

        Studio Roles page groups the per-tag tri-state by and marks the
        ``fenced``/``secret``

        (admin-only) routes it must never offer a grant for. The join is keyed
        on the route

        TEMPLATE + its method set with ``HEAD`` stripped on BOTH sides
        (Starlette auto-adds

        ``HEAD`` to a GET), so the two collections compare like-for-like; a
        registered route

        whose method set fails to join is a loud STOP (a normalization drift),
        never a

        silently dropped row.
      operationId: get_api_auth_routes
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  data: {}
                required:
                  - data
                type: object
          description: Success.
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Missing or invalid api key.
      security:
        - ApiKeyAuth: []
components:
  schemas:
    Error:
      properties:
        error:
          type: string
      required:
        - error
      type: object
  securitySchemes:
    ApiKeyAuth:
      in: header
      name: x-api-key
      type: apiKey

````