Register an API endpoint

Adds a route to the endpoint registry. Returns 200 with the created entity, not 201.

Authorization

bearerAuth

AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Body of POST /v1/rbac/endpoints. An omitted active stores false. The server runs no field validation here: an omitted or unrecognised method reaches the http_method database enum and comes back as 500, not 400.

endpoint*string

Route pattern. Mind the form: the startup sync does NOT store patterns verbatim. RegisterAPIEndpoints stores makeSQLFriendly(route.Pattern) (common/rbac/rbac_api.go), which replaces every {segment} with a literal % — the committed seeds read /v1/accounts/% and /v1/misc/feeds/%/% — and keeps the original only in metadata.pattern. THIS route does no such rewriting: AddAPIEndpoint stores the string you send, unchanged. So registering "/v1/accounts/{id}" by hand creates a row that the auto-registered "/v1/accounts/%" does not collide with and that permission lookups matching on the stored form will not find. Send the % form unless you deliberately want a distinct row.

method*string

active?boolean

metadata?|null

Response Body

`application/json`

curl -X POST "https://example.com/v1/rbac/endpoints" \  -H "Content-Type: application/json" \  -d '{    "endpoint": "/v1/accounts/%",    "method": "GET"  }'

{
  "endpoint": "/v1/accounts/%",
  "method": "GET",
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "created_at": "2019-08-24T14:15:22Z",
  "created_by": "ee824cad-d7a6-4f48-87dc-e8461a9201c4",
  "modified_at": "2019-08-24T14:15:22Z",
  "modified_by": "e8d4374d-93a1-4e98-a6c6-fdcf00c5059f",
  "active": true,
  "metadata": {}
}

{
  "status": 400,
  "code": "common.invalid_input",
  "message": "Invalid input data",
  "details": [
    {
      "field": "actor_id",
      "rule": "required",
      "param": "string",
      "message": "actor_id is required"
    }
  ],
  "class": "validation",
  "retryable": false
}

{
  "status": 400,
  "code": "common.invalid_input",
  "message": "Invalid input data",
  "details": [
    {
      "field": "actor_id",
      "rule": "required",
      "param": "string",
      "message": "actor_id is required"
    }
  ],
  "class": "validation",
  "retryable": false
}

{
  "status": 400,
  "code": "common.invalid_input",
  "message": "Invalid input data",
  "details": [
    {
      "field": "actor_id",
      "rule": "required",
      "param": "string",
      "message": "actor_id is required"
    }
  ],
  "class": "validation",
  "retryable": false
}

{
  "status": 429,
  "message": "Global rate limit exceeded",
  "code": "Global rate limit exceeded",
  "class": "temporary",
  "retryable": true
}

{
  "status": 400,
  "code": "common.invalid_input",
  "message": "Invalid input data",
  "details": [
    {
      "field": "actor_id",
      "rule": "required",
      "param": "string",
      "message": "actor_id is required"
    }
  ],
  "class": "validation",
  "retryable": false
}

{
  "overall_status": "unhealthy",
  "message": "Service is shutting down",
  "timestamp": "2026-08-27T15:04:05Z"
}

Authorization

Request Body

Response Body

200application/json

400application/json

401application/json

403application/json

429application/json

500application/json

503application/json

Before authentication — per-IP global counter, free-text code

Authenticated — a limit configured on the api_permission row

Graceful shutdown — LifecycleMiddleware, root router, not the envelope

ensureCacheAvailable could not reach the auth cache — the envelope

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`