sami7777/dashcaddy

Fork 0

Files

T

Hermes Agent f405186eb8

CI / Test & Lint (push) Has been cancelled

Details

CI / Security audit (push) Has been cancelled

Details

Add API-SURFACE.md — full route inventory with auth + rate-limit classification

Generated from static analysis of router.*() registrations across
47 route files. Covers 285 routes grouped into 29 feature areas.
Each entry includes method, full path, auth classification
(public/protected per PUBLIC_ROUTES allowlist), rate-limit bucket
(GENERAL/STRICT/TOTP), and source file:line.

Also cross-checks against openapi.yaml: 142 routes undocumented,
18 stale paths in spec. This is a real gap that should be fixed
before v1.0 public release.

2026-07-13 00:59:22 -07:00

38 KiB

Raw Blame History

DashCaddy API Surface

Generated: 2026-07-13
Total routes: 285
Files scanned: 47
Source of truth: router.* registrations in dashcaddy-api/routes/ + root paths in src/app.js

Auth & Rate Limit Model

Auth classification:

public = in PUBLIC_ROUTES allowlist (src/utilities/middleware.js:310-364), bypasses TOTP
protected = requires valid TOTP session cookie (dashcaddy_session) OR API key/JWT token

Rate limits (from RATE_LIMITS in src/utilities/constants.js:69):

GENERAL = 1000 req / 15 min / IP — default for all /api/v1/*
STRICT = 20 req / 15 min / IP — auth key endpoints (/auth/keys, /auth/jwt, /auth/gate, /auth/app-token)
TOTP = 10 req / 15 min / IP — TOTP verify/setup

CSRF: TOTP session uses double-submit cookie pattern. State-changing requests (POST/PUT/DELETE/PATCH) require X-CSRF-Token header matching the csrf_token cookie.

Summary by Area

Area	Routes	Public	Protected
App catalog	28	0	28
Tailscale	20	20	0
Backups	19	0	19
DNS	19	0	19
Monitoring	19	3	16
Updates	16	6	10
Authentication	15	10	5
Logs	15	0	15
Configuration	13	9	4
Health	12	2	10
Services	12	4	8
Containers (lifecycle)	10	0	10
Core / system	9	6	3
Dependencies	8	0	8
Notifications	8	0	8
App recipes	8	0	8
Docker resources	7	0	7
Caddy / sites	7	0	7
Updates / workflows	6	0	6
Auto-restart	5	0	5
Certificate authority	5	5	0
OpenClaw integration	5	0	5
Config drift	4	0	4
Licensing	4	2	2
File browser	3	0	3
Theming	3	1	2
Service credentials	2	0	2
Events	2	0	2
Internal helpers	1	0	1
TOTAL	285	68	217

App catalog

28 routes

Method	Full path	Auth	Rate limit	Defined in
DELETE	`/api/v1/:appId`	protected	GENERAL (1000/15m)	`routes/apps/removal.js:39`
GET	`/api/v1/:appId/backup-points`	protected	GENERAL (1000/15m)	`routes/apps/restore.js:131`
POST	`/api/v1/:appId/restore`	protected	GENERAL (1000/15m)	`routes/apps/restore.js:38`
POST	`/api/v1/:appId/revert/:filename`	protected	GENERAL (1000/15m)	`routes/apps/restore.js:185`
POST	`/api/v1/arr/auto-setup`	protected	GENERAL (1000/15m)	`routes/arr/config.js:282`
POST	`/api/v1/arr/configure-overseerr`	protected	GENERAL (1000/15m)	`routes/arr/config.js:27`
GET	`/api/v1/arr/credentials`	protected	GENERAL (1000/15m)	`routes/arr/credentials.js:109`
POST	`/api/v1/arr/credentials`	protected	GENERAL (1000/15m)	`routes/arr/credentials.js:21`
DELETE	`/api/v1/arr/credentials/:service`	protected	GENERAL (1000/15m)	`routes/arr/credentials.js:134`
GET	`/api/v1/arr/detect`	protected	GENERAL (1000/15m)	`routes/arr/detect.js:20`
GET	`/api/v1/arr/quality-profiles`	protected	GENERAL (1000/15m)	`routes/arr/config.js:497`
POST	`/api/v1/arr/quality-profiles`	protected	GENERAL (1000/15m)	`routes/arr/config.js:566`
POST	`/api/v1/arr/smart-connect`	protected	GENERAL (1000/15m)	`routes/arr/smart-connect.js:26`
GET	`/api/v1/arr/smart-detect`	protected	GENERAL (1000/15m)	`routes/arr/detect.js:78`
POST	`/api/v1/arr/test-connection`	protected	GENERAL (1000/15m)	`routes/arr/config.js:208`
POST	`/api/v1/check-existing`	protected	GENERAL (1000/15m)	`routes/apps/deploy.js:241`
DELETE	`/api/v1/compose-stack/:stackName`	protected	GENERAL (1000/15m)	`routes/apps/compose.js:308`
POST	`/api/v1/deploy`	protected	GENERAL (1000/15m)	`routes/apps/deploy.js:254`
POST	`/api/v1/deploy-compose`	protected	GENERAL (1000/15m)	`routes/apps/compose.js:170`
POST	`/api/v1/import-compose`	protected	GENERAL (1000/15m)	`routes/apps/compose.js:159`
GET	`/api/v1/plex/libraries`	protected	GENERAL (1000/15m)	`routes/arr/plex.js:26`
GET	`/api/v1/ports/:basePort/suggest`	protected	GENERAL (1000/15m)	`routes/apps/templates.js:77`
GET	`/api/v1/ports/:port/check`	protected	GENERAL (1000/15m)	`routes/apps/templates.js:65`
POST	`/api/v1/restore-all`	protected	GENERAL (1000/15m)	`routes/apps/restore.js:58`
GET	`/api/v1/restore-status`	protected	GENERAL (1000/15m)	`routes/apps/restore.js:97`
GET	`/api/v1/templates`	protected	GENERAL (1000/15m)	`routes/apps/templates.js:45`
GET	`/api/v1/templates/:appId`	protected	GENERAL (1000/15m)	`routes/apps/templates.js:54`
POST	`/api/v1/update-subdomain`	protected	GENERAL (1000/15m)	`routes/apps/templates.js:91`

Tailscale

20 routes

Method	Full path	Auth	Rate limit	Defined in
GET	`/api/v1/tailscale/acl`	public	GENERAL (1000/15m)	`routes/tailscale.js:301`
GET	`/api/v1/tailscale/admin/devices`	public	GENERAL (1000/15m)	`routes/tailscale-admin.js:154`
DELETE	`/api/v1/tailscale/admin/devices/:id`	public	GENERAL (1000/15m)	`routes/tailscale-admin.js:170`
GET	`/api/v1/tailscale/admin/keys`	public	GENERAL (1000/15m)	`routes/tailscale-admin.js:202`
POST	`/api/v1/tailscale/admin/keys`	public	GENERAL (1000/15m)	`routes/tailscale-admin.js:211`
DELETE	`/api/v1/tailscale/admin/keys/:id`	public	GENERAL (1000/15m)	`routes/tailscale-admin.js:237`
GET	`/api/v1/tailscale/admin/users`	public	GENERAL (1000/15m)	`routes/tailscale-admin.js:191`
GET	`/api/v1/tailscale/api-devices`	public	GENERAL (1000/15m)	`routes/tailscale.js:274`
GET	`/api/v1/tailscale/check-connection`	public	GENERAL (1000/15m)	`routes/tailscale.js:96`
POST	`/api/v1/tailscale/config`	public	GENERAL (1000/15m)	`routes/tailscale.js:80`
GET	`/api/v1/tailscale/devices`	public	GENERAL (1000/15m)	`routes/tailscale.js:113`
DELETE	`/api/v1/tailscale/oauth-config`	public	GENERAL (1000/15m)	`routes/tailscale.js:259`
POST	`/api/v1/tailscale/oauth-config`	public	GENERAL (1000/15m)	`routes/tailscale.js:201`
POST	`/api/v1/tailscale/protect-service`	public	GENERAL (1000/15m)	`routes/tailscale.js:147`
DELETE	`/api/v1/tailscale/settings`	public	GENERAL (1000/15m)	`routes/tailscale-admin.js:124`
GET	`/api/v1/tailscale/settings`	public	GENERAL (1000/15m)	`routes/tailscale-admin.js:60`
PUT	`/api/v1/tailscale/settings`	public	GENERAL (1000/15m)	`routes/tailscale-admin.js:76`
POST	`/api/v1/tailscale/settings/test`	public	GENERAL (1000/15m)	`routes/tailscale-admin.js:131`
GET	`/api/v1/tailscale/status`	public	GENERAL (1000/15m)	`routes/tailscale.js:36`
POST	`/api/v1/tailscale/sync`	public	GENERAL (1000/15m)	`routes/tailscale.js:287`

Backups

19 routes

Method	Full path	Auth	Rate limit	Defined in
POST	`/api/v1/backups/backup/:appId`	protected	GENERAL (1000/15m)	`routes/backups.js:161`
POST	`/api/v1/backups/compare/:filename`	protected	GENERAL (1000/15m)	`routes/backups.js:373`
GET	`/api/v1/backups/config`	protected	GENERAL (1000/15m)	`routes/backups.js:480`
POST	`/api/v1/backups/config`	protected	GENERAL (1000/15m)	`routes/backups.js:486`
DELETE	`/api/v1/backups/credentials/:provider`	protected	GENERAL (1000/15m)	`routes/backups.js:631`
GET	`/api/v1/backups/credentials/:provider`	protected	GENERAL (1000/15m)	`routes/backups.js:558`
POST	`/api/v1/backups/credentials/:provider`	protected	GENERAL (1000/15m)	`routes/backups.js:590`
POST	`/api/v1/backups/execute`	protected	GENERAL (1000/15m)	`routes/backups.js:492`
GET	`/api/v1/backups/files`	protected	GENERAL (1000/15m)	`routes/backups.js:118`
GET	`/api/v1/backups/files/:appId`	protected	GENERAL (1000/15m)	`routes/backups.js:189`
GET	`/api/v1/backups/history`	protected	GENERAL (1000/15m)	`routes/backups.js:498`
POST	`/api/v1/backups/restore-file/:filename`	protected	GENERAL (1000/15m)	`routes/backups.js:237`
POST	`/api/v1/backups/restore/:backupId`	protected	GENERAL (1000/15m)	`routes/backups.js:538`
GET	`/api/v1/backups/schedule`	protected	GENERAL (1000/15m)	`routes/backups.js:29`
POST	`/api/v1/backups/schedule`	protected	GENERAL (1000/15m)	`routes/backups.js:59`
POST	`/api/v1/backups/schedule`	protected	GENERAL (1000/15m)	`routes/backups.js:511`
DELETE	`/api/v1/backups/schedule/:appId`	protected	GENERAL (1000/15m)	`routes/backups.js:102`
GET	`/api/v1/backups/storage-info`	protected	GENERAL (1000/15m)	`routes/backups.js:505`
POST	`/api/v1/backups/test-destination`	protected	GENERAL (1000/15m)	`routes/backups.js:546`

DNS

19 routes

Method	Full path	Auth	Rate limit	Defined in
GET	`/api/v1/dns/check-update`	protected	GENERAL (1000/15m)	`routes/dns.js:669`
DELETE	`/api/v1/dns/credentials`	protected	GENERAL (1000/15m)	`routes/dns.js:597`
POST	`/api/v1/dns/credentials`	protected	GENERAL (1000/15m)	`routes/dns.js:490`
GET	`/api/v1/dns/logs`	protected	GENERAL (1000/15m)	`routes/dns.js:337`
GET	`/api/v1/dns/propagation`	protected	GENERAL (1000/15m)	`routes/dns.js:802`
GET	`/api/v1/dns/propagation/:domain`	protected	GENERAL (1000/15m)	`routes/dns.js:847`
POST	`/api/v1/dns/propagation/verify`	protected	GENERAL (1000/15m)	`routes/dns.js:815`
GET	`/api/v1/dns/provider/status`	protected	GENERAL (1000/15m)	`routes/dns.js:55`
GET	`/api/v1/dns/providers`	protected	GENERAL (1000/15m)	`routes/dns.js:48`
DELETE	`/api/v1/dns/record`	protected	GENERAL (1000/15m)	`routes/dns.js:176`
POST	`/api/v1/dns/record`	protected	GENERAL (1000/15m)	`routes/dns.js:225`
POST	`/api/v1/dns/refresh-token`	protected	GENERAL (1000/15m)	`routes/dns.js:655`
GET	`/api/v1/dns/resolve`	protected	GENERAL (1000/15m)	`routes/dns.js:292`
POST	`/api/v1/dns/restart/:dnsId`	protected	GENERAL (1000/15m)	`routes/dns.js:621`
GET	`/api/v1/dns/token-status`	protected	GENERAL (1000/15m)	`routes/dns.js:474`
DELETE	`/api/v1/dns/universal/record`	protected	GENERAL (1000/15m)	`routes/dns.js:119`
POST	`/api/v1/dns/universal/record`	protected	GENERAL (1000/15m)	`routes/dns.js:71`
GET	`/api/v1/dns/universal/resolve`	protected	GENERAL (1000/15m)	`routes/dns.js:145`
POST	`/api/v1/dns/update`	protected	GENERAL (1000/15m)	`routes/dns.js:732`

Monitoring

19 routes

Method	Full path	Auth	Rate limit	Defined in
GET	`/api/v1/certificates`	protected	GENERAL (1000/15m)	`routes/ssl-monitor.js:26`
GET	`/api/v1/certificates/:serviceId`	protected	GENERAL (1000/15m)	`routes/ssl-monitor.js:35`
POST	`/api/v1/check`	protected	GENERAL (1000/15m)	`routes/ssl-monitor.js:50`
POST	`/api/v1/check/:serviceId`	protected	GENERAL (1000/15m)	`routes/ssl-monitor.js:59`
GET	`/api/v1/config`	public	GENERAL (1000/15m)	`routes/ssl-monitor.js:80`
POST	`/api/v1/config`	public	GENERAL (1000/15m)	`routes/ssl-monitor.js:90`
GET	`/api/v1/monitoring/aggregated/:containerId`	protected	GENERAL (1000/15m)	`routes/monitoring.js:72`
GET	`/api/v1/monitoring/alerts`	protected	GENERAL (1000/15m)	`routes/monitoring.js:104`
DELETE	`/api/v1/monitoring/alerts/:containerId`	protected	GENERAL (1000/15m)	`routes/monitoring.js:174`
GET	`/api/v1/monitoring/alerts/:containerId`	protected	GENERAL (1000/15m)	`routes/monitoring.js:168`
POST	`/api/v1/monitoring/alerts/:containerId`	protected	GENERAL (1000/15m)	`routes/monitoring.js:162`
POST	`/api/v1/monitoring/alerts/:containerId/test`	protected	GENERAL (1000/15m)	`routes/monitoring.js:111`
GET	`/api/v1/monitoring/alerts/config`	protected	GENERAL (1000/15m)	`routes/monitoring.js:85`
POST	`/api/v1/monitoring/alerts/config`	protected	GENERAL (1000/15m)	`routes/monitoring.js:91`
GET	`/api/v1/monitoring/history/:containerId`	protected	GENERAL (1000/15m)	`routes/monitoring.js:49`
GET	`/api/v1/monitoring/stats`	public	GENERAL (1000/15m)	`routes/monitoring.js:20`
GET	`/api/v1/monitoring/stats/:containerId`	protected	GENERAL (1000/15m)	`routes/monitoring.js:38`
GET	`/api/v1/stats/container/:id`	protected	GENERAL (1000/15m)	`routes/monitoring.js:240`
GET	`/api/v1/stats/containers`	protected	GENERAL (1000/15m)	`routes/monitoring.js:182`

Updates

16 routes

Method	Full path	Auth	Rate limit	Defined in
POST	`/api/v1/system/rollback`	protected	GENERAL (1000/15m)	`routes/updates.js:164`
GET	`/api/v1/system/rollback-versions`	protected	GENERAL (1000/15m)	`routes/updates.js:158`
POST	`/api/v1/system/update-apply`	protected	GENERAL (1000/15m)	`routes/updates.js:95`
GET	`/api/v1/system/update-check`	public	GENERAL (1000/15m)	`routes/updates.js:89`
GET	`/api/v1/system/update-history`	public	GENERAL (1000/15m)	`routes/updates.js:152`
POST	`/api/v1/system/update-notify`	public	GENERAL (1000/15m)	`routes/updates.js:126`
GET	`/api/v1/system/update-status`	public	GENERAL (1000/15m)	`routes/updates.js:143`
GET	`/api/v1/system/version`	public	GENERAL (1000/15m)	`routes/updates.js:83`
GET	`/api/v1/updates/auto-update`	protected	GENERAL (1000/15m)	`routes/updates.js:65`
POST	`/api/v1/updates/auto-update/:containerId`	protected	GENERAL (1000/15m)	`routes/updates.js:59`
GET	`/api/v1/updates/available`	public	GENERAL (1000/15m)	`routes/updates.js:29`
POST	`/api/v1/updates/check`	protected	GENERAL (1000/15m)	`routes/updates.js:22`
GET	`/api/v1/updates/history`	protected	GENERAL (1000/15m)	`routes/updates.js:49`
POST	`/api/v1/updates/rollback/:containerId`	protected	GENERAL (1000/15m)	`routes/updates.js:43`
POST	`/api/v1/updates/schedule/:containerId`	protected	GENERAL (1000/15m)	`routes/updates.js:71`
POST	`/api/v1/updates/update/:containerId`	protected	GENERAL (1000/15m)	`routes/updates.js:37`

Authentication

15 routes

Method	Full path	Auth	Rate limit	Defined in
GET	`/api/v1/auth/app-token/:serviceId`	public	STRICT (20/15m)	`routes/auth/sso-gate.js:104`
GET	`/api/v1/auth/gate/:serviceId`	public	STRICT (20/15m)	`routes/auth/sso-gate.js:26`
POST	`/api/v1/auth/jwt`	protected	STRICT (20/15m)	`routes/auth/keys.js:103`
GET	`/api/v1/auth/keys`	protected	STRICT (20/15m)	`routes/auth/keys.js:36`
POST	`/api/v1/auth/keys`	protected	STRICT (20/15m)	`routes/auth/keys.js:47`
DELETE	`/api/v1/auth/keys/:keyId`	protected	STRICT (20/15m)	`routes/auth/keys.js:81`
GET	`/api/v1/auth/login-page`	public	GENERAL (1000/15m)	`routes/auth/sso-gate.js:206`
GET	`/api/v1/totp/check-session`	public	TOTP (10/15m)	`routes/auth/totp.js:228`
GET	`/api/v1/totp/config`	public	TOTP (10/15m)	`routes/auth/totp.js:30`
POST	`/api/v1/totp/config`	public	TOTP (10/15m)	`routes/auth/totp.js:286`
POST	`/api/v1/totp/disable`	protected	TOTP (10/15m)	`routes/auth/totp.js:253`
GET	`/api/v1/totp/recovery-info`	public	TOTP (10/15m)	`routes/auth/totp.js:56`
POST	`/api/v1/totp/setup`	public	TOTP (10/15m)	`routes/auth/totp.js:116`
POST	`/api/v1/totp/verify`	public	TOTP (10/15m)	`routes/auth/totp.js:194`
POST	`/api/v1/totp/verify-setup`	public	TOTP (10/15m)	`routes/auth/totp.js:157`

Logs

15 routes

Method	Full path	Auth	Rate limit	Defined in
DELETE	`/api/v1/audit-logs`	protected	GENERAL (1000/15m)	`routes/errorlogs.js:71`
GET	`/api/v1/audit-logs`	protected	GENERAL (1000/15m)	`routes/errorlogs.js:55`
DELETE	`/api/v1/error-logs`	protected	GENERAL (1000/15m)	`routes/errorlogs.js:47`
GET	`/api/v1/error-logs`	protected	GENERAL (1000/15m)	`routes/errorlogs.js:20`
GET	`/api/v1/logs/container/:id`	protected	GENERAL (1000/15m)	`routes/logs.js:39`
GET	`/api/v1/logs/containers`	protected	GENERAL (1000/15m)	`routes/logs.js:23`
GET	`/api/v1/logs/digest/:date`	protected	GENERAL (1000/15m)	`routes/logs.js:184`
POST	`/api/v1/logs/digest/generate`	protected	GENERAL (1000/15m)	`routes/logs.js:176`
GET	`/api/v1/logs/digest/history`	protected	GENERAL (1000/15m)	`routes/logs.js:169`
GET	`/api/v1/logs/digest/latest`	protected	GENERAL (1000/15m)	`routes/logs.js:152`
GET	`/api/v1/logs/digest/live`	protected	GENERAL (1000/15m)	`routes/logs.js:162`
GET	`/api/v1/logs/docker-disk`	protected	GENERAL (1000/15m)	`routes/logs.js:203`
POST	`/api/v1/logs/docker-maintenance`	protected	GENERAL (1000/15m)	`routes/logs.js:211`
GET	`/api/v1/logs/file`	protected	GENERAL (1000/15m)	`routes/logs.js:218`
GET	`/api/v1/logs/stream/:id`	protected	GENERAL (1000/15m)	`routes/logs.js:93`

Configuration

13 routes

Method	Full path	Auth	Rate limit	Defined in
POST	`/api/v1/assets/upload`	protected	GENERAL (1000/15m)	`routes/config/assets.js:33`
GET	`/api/v1/backup/export`	protected	GENERAL (1000/15m)	`routes/config/backup.js:51`
POST	`/api/v1/backup/preview`	protected	GENERAL (1000/15m)	`routes/config/backup.js:153`
POST	`/api/v1/backup/restore`	protected	GENERAL (1000/15m)	`routes/config/backup.js:218`
DELETE	`/api/v1/config`	public	GENERAL (1000/15m)	`routes/config/settings.js:78`
GET	`/api/v1/config`	public	GENERAL (1000/15m)	`routes/config/settings.js:26`
POST	`/api/v1/config`	public	GENERAL (1000/15m)	`routes/config/settings.js:35`
DELETE	`/api/v1/favicon`	public	GENERAL (1000/15m)	`routes/config/assets.js:272`
GET	`/api/v1/favicon`	public	GENERAL (1000/15m)	`routes/config/assets.js:203`
POST	`/api/v1/favicon`	public	GENERAL (1000/15m)	`routes/config/assets.js:212`
DELETE	`/api/v1/logo`	public	GENERAL (1000/15m)	`routes/config/assets.js:170`
GET	`/api/v1/logo`	public	GENERAL (1000/15m)	`routes/config/assets.js:77`
POST	`/api/v1/logo`	public	GENERAL (1000/15m)	`routes/config/assets.js:112`

Health

12 routes

Method	Full path	Auth	Rate limit	Defined in
DELETE	`/api/v1/health-checks/:serviceId/configure`	protected	GENERAL (1000/15m)	`routes/health.js:357`
POST	`/api/v1/health-checks/:serviceId/configure`	protected	GENERAL (1000/15m)	`routes/health.js:351`
GET	`/api/v1/health-checks/:serviceId/stats`	protected	GENERAL (1000/15m)	`routes/health.js:340`
GET	`/api/v1/health-checks/incidents`	protected	GENERAL (1000/15m)	`routes/health.js:363`
GET	`/api/v1/health-checks/incidents/history`	protected	GENERAL (1000/15m)	`routes/health.js:371`
GET	`/api/v1/health-checks/status`	public	GENERAL (1000/15m)	`routes/health.js:319`
GET	`/api/v1/health/ca`	public	GENERAL (1000/15m)	`routes/health.js:267`
GET	`/api/v1/health/cached`	protected	GENERAL (1000/15m)	`routes/health.js:179`
GET	`/api/v1/health/probe`	protected	GENERAL (1000/15m)	`routes/health.js:230`
GET	`/api/v1/health/pylon`	protected	GENERAL (1000/15m)	`routes/health.js:245`
GET	`/api/v1/health/service/:id`	protected	GENERAL (1000/15m)	`routes/health.js:188`
GET	`/api/v1/health/services`	protected	GENERAL (1000/15m)	`routes/health.js:109`

Services

12 routes

Method	Full path	Auth	Rate limit	Defined in
DELETE	`/api/v1/seedhost-creds`	protected	GENERAL (1000/15m)	`routes/services.js:310`
GET	`/api/v1/seedhost-creds`	protected	GENERAL (1000/15m)	`routes/services.js:289`
POST	`/api/v1/seedhost-creds`	protected	GENERAL (1000/15m)	`routes/services.js:272`
GET	`/api/v1/services`	public	GENERAL (1000/15m)	`routes/services.js:374`
POST	`/api/v1/services`	public	GENERAL (1000/15m)	`routes/services.js:389`
PUT	`/api/v1/services`	public	GENERAL (1000/15m)	`routes/services.js:434`
DELETE	`/api/v1/services/:id`	protected	GENERAL (1000/15m)	`routes/services.js:462`
DELETE	`/api/v1/services/:serviceId/credentials`	protected	GENERAL (1000/15m)	`routes/services.js:237`
GET	`/api/v1/services/:serviceId/credentials`	protected	GENERAL (1000/15m)	`routes/services.js:252`
POST	`/api/v1/services/:serviceId/credentials`	protected	GENERAL (1000/15m)	`routes/services.js:213`
GET	`/api/v1/services/status`	public	GENERAL (1000/15m)	`routes/services.js:327`
POST	`/api/v1/services/update`	protected	GENERAL (1000/15m)	`routes/services.js:486`

Containers (lifecycle)

10 routes

Method	Full path	Auth	Rate limit	Defined in
DELETE	`/api/v1/containers/:id`	protected	GENERAL (1000/15m)	`routes/containers.js:235`
GET	`/api/v1/containers/:id/check-update`	protected	GENERAL (1000/15m)	`routes/containers.js:155`
GET	`/api/v1/containers/:id/logs`	protected	GENERAL (1000/15m)	`routes/containers.js:193`
GET	`/api/v1/containers/:id/resources`	protected	GENERAL (1000/15m)	`routes/containers.js:223`
PUT	`/api/v1/containers/:id/resources`	protected	GENERAL (1000/15m)	`routes/containers.js:205`
POST	`/api/v1/containers/:id/restart`	protected	GENERAL (1000/15m)	`routes/containers.js:48`
POST	`/api/v1/containers/:id/start`	protected	GENERAL (1000/15m)	`routes/containers.js:34`
POST	`/api/v1/containers/:id/stop`	protected	GENERAL (1000/15m)	`routes/containers.js:41`
POST	`/api/v1/containers/:id/update`	protected	GENERAL (1000/15m)	`routes/containers.js:55`
GET	`/api/v1/containers/discover`	protected	GENERAL (1000/15m)	`routes/containers.js:242`

Core / system

9 routes

Method	Full path	Auth	Rate limit	Defined in
GET	`/api/v1/docs`	protected	GENERAL (1000/15m)	`src/app.js:925`
GET	`/api/v1/docs/spec`	protected	GENERAL (1000/15m)	`src/app.js:943`
GET	`/api/v1/network/ips`	protected	GENERAL (1000/15m)	`src/app.js:899`
GET	`/health`	public	GENERAL (1000/15m)	`src/app.js:777`
GET	`/health/live`	public	GENERAL (1000/15m)	`src/app.js:778`
GET	`/health/ready`	public	GENERAL (1000/15m)	`src/app.js:782`
GET	`/healthz`	public	GENERAL (1000/15m)	`src/app.js:779`
GET	`/probe/:id`	public	GENERAL (1000/15m)	`src/app.js:786`
GET	`/readyz`	public	GENERAL (1000/15m)	`src/app.js:783`

Dependencies

8 routes

Method	Full path	Auth	Rate limit	Defined in
DELETE	`/api/v1/dependencies/:serviceId`	protected	GENERAL (1000/15m)	`routes/dependencies.js:166`
GET	`/api/v1/dependencies/:serviceId`	protected	GENERAL (1000/15m)	`routes/dependencies.js:80`
POST	`/api/v1/dependencies/:serviceId`	protected	GENERAL (1000/15m)	`routes/dependencies.js:123`
GET	`/api/v1/dependencies/:serviceId/chain`	protected	GENERAL (1000/15m)	`routes/dependencies.js:105`
POST	`/api/v1/dependencies/:serviceId/restart`	protected	GENERAL (1000/15m)	`routes/dependencies.js:198`
GET	`/api/v1/dependencies/:serviceId/status`	protected	GENERAL (1000/15m)	`routes/dependencies.js:114`
GET	`/api/v1/dependencies/graph`	protected	GENERAL (1000/15m)	`routes/dependencies.js:48`
GET	`/api/v1/dependencies/validate`	protected	GENERAL (1000/15m)	`routes/dependencies.js:56`

Notifications

8 routes

Method	Full path	Auth	Rate limit	Defined in
GET	`/api/v1/notifications/config`	protected	GENERAL (1000/15m)	`routes/notifications.js:20`
POST	`/api/v1/notifications/config`	protected	GENERAL (1000/15m)	`routes/notifications.js:53`
POST	`/api/v1/notifications/health-check`	protected	GENERAL (1000/15m)	`routes/notifications.js:214`
DELETE	`/api/v1/notifications/history`	protected	GENERAL (1000/15m)	`routes/notifications.js:208`
GET	`/api/v1/notifications/history`	protected	GENERAL (1000/15m)	`routes/notifications.js:192`
POST	`/api/v1/notifications/send`	protected	GENERAL (1000/15m)	`routes/notifications.js:246`
GET	`/api/v1/notifications/status`	protected	GENERAL (1000/15m)	`routes/notifications.js:224`
POST	`/api/v1/notifications/test`	protected	GENERAL (1000/15m)	`routes/notifications.js:159`

App recipes

8 routes

Method	Full path	Auth	Rate limit	Defined in
DELETE	`/api/v1/:recipeId`	protected	GENERAL (1000/15m)	`routes/recipes/manage.js:197`
POST	`/api/v1/:recipeId/restart`	protected	GENERAL (1000/15m)	`routes/recipes/manage.js:171`
POST	`/api/v1/:recipeId/start`	protected	GENERAL (1000/15m)	`routes/recipes/manage.js:108`
POST	`/api/v1/:recipeId/stop`	protected	GENERAL (1000/15m)	`routes/recipes/manage.js:139`
POST	`/api/v1/deploy`	protected	GENERAL (1000/15m)	`routes/recipes/deploy.js:29`
GET	`/api/v1/deployed`	protected	GENERAL (1000/15m)	`routes/recipes/manage.js:24`
GET	`/api/v1/templates`	protected	GENERAL (1000/15m)	`routes/recipes/index.js:34`
GET	`/api/v1/templates/:recipeId`	protected	GENERAL (1000/15m)	`routes/recipes/index.js:63`

Docker resources

7 routes

Method	Full path	Auth	Rate limit	Defined in
GET	`/api/v1/docker/disk-usage`	protected	GENERAL (1000/15m)	`routes/docker-resources.js:84`
GET	`/api/v1/docker/networks`	protected	GENERAL (1000/15m)	`routes/docker-resources.js:50`
POST	`/api/v1/docker/networks`	protected	GENERAL (1000/15m)	`routes/docker-resources.js:64`
DELETE	`/api/v1/docker/networks/:id`	protected	GENERAL (1000/15m)	`routes/docker-resources.js:76`
GET	`/api/v1/docker/volumes`	protected	GENERAL (1000/15m)	`routes/docker-resources.js:17`
POST	`/api/v1/docker/volumes`	protected	GENERAL (1000/15m)	`routes/docker-resources.js:30`
DELETE	`/api/v1/docker/volumes/:name`	protected	GENERAL (1000/15m)	`routes/docker-resources.js:42`

Caddy / sites

7 routes

Method	Full path	Auth	Rate limit	Defined in
GET	`/api/v1/caddy/cas`	protected	GENERAL (1000/15m)	`routes/sites.js:57`
GET	`/api/v1/caddy/config`	protected	GENERAL (1000/15m)	`routes/sites.js:31`
POST	`/api/v1/caddy/reload`	protected	GENERAL (1000/15m)	`routes/sites.js:38`
GET	`/api/v1/caddyfile`	protected	GENERAL (1000/15m)	`routes/sites.js:25`
POST	`/api/v1/site`	protected	GENERAL (1000/15m)	`routes/sites.js:160`
DELETE	`/api/v1/site/:domain`	protected	GENERAL (1000/15m)	`routes/sites.js:135`
POST	`/api/v1/site/external`	protected	GENERAL (1000/15m)	`routes/sites.js:188`

Updates / workflows

6 routes

Method	Full path	Auth	Rate limit	Defined in
GET	`/api/v1/workflows/workflows`	protected	GENERAL (1000/15m)	`routes/workflows.js:22`
POST	`/api/v1/workflows/workflows/:workflowId/disable`	protected	GENERAL (1000/15m)	`routes/workflows.js:35`
POST	`/api/v1/workflows/workflows/:workflowId/enable`	protected	GENERAL (1000/15m)	`routes/workflows.js:28`
GET	`/api/v1/workflows/workflows/:workflowId/history`	protected	GENERAL (1000/15m)	`routes/workflows.js:52`
POST	`/api/v1/workflows/workflows/:workflowId/run`	protected	GENERAL (1000/15m)	`routes/workflows.js:42`
GET	`/api/v1/workflows/workflows/history`	protected	GENERAL (1000/15m)	`routes/workflows.js:60`

Auto-restart

5 routes

Method	Full path	Auth	Rate limit	Defined in
GET	`/api/v1/policies`	protected	GENERAL (1000/15m)	`routes/auto-restart.js:30`
DELETE	`/api/v1/policies/:serviceId`	protected	GENERAL (1000/15m)	`routes/auto-restart.js:103`
GET	`/api/v1/policies/:serviceId`	protected	GENERAL (1000/15m)	`routes/auto-restart.js:39`
POST	`/api/v1/policies/:serviceId`	protected	GENERAL (1000/15m)	`routes/auto-restart.js:60`
POST	`/api/v1/policies/:serviceId/test`	protected	GENERAL (1000/15m)	`routes/auto-restart.js:123`

Certificate authority

5 routes

Method	Full path	Auth	Rate limit	Defined in
GET	`/api/v1/ca/cert/:domain`	public	GENERAL (1000/15m)	`routes/ca.js:127`
GET	`/api/v1/ca/certs`	public	GENERAL (1000/15m)	`routes/ca.js:242`
GET	`/api/v1/ca/info`	public	GENERAL (1000/15m)	`routes/ca.js:15`
GET	`/api/v1/ca/install-script`	public	GENERAL (1000/15m)	`routes/ca.js:63`
GET	`/api/v1/ca/root.crt`	public	GENERAL (1000/15m)	`routes/ca.js:45`

OpenClaw integration

5 routes

Method	Full path	Auth	Rate limit	Defined in
DELETE	`/api/v1/openclaw/`	protected	GENERAL (1000/15m)	`routes/openclaw.js:244`
POST	`/api/v1/openclaw/deploy`	protected	GENERAL (1000/15m)	`routes/openclaw.js:150`
GET	`/api/v1/openclaw/proxy/*`	protected	GENERAL (1000/15m)	`routes/openclaw.js:216`
POST	`/api/v1/openclaw/proxy/*`	protected	GENERAL (1000/15m)	`routes/openclaw.js:230`
GET	`/api/v1/openclaw/status`	protected	GENERAL (1000/15m)	`routes/openclaw.js:116`

Config drift

4 routes

Method	Full path	Auth	Rate limit	Defined in
POST	`/api/v1/fix`	protected	GENERAL (1000/15m)	`routes/config-drift.js:51`
GET	`/api/v1/last`	protected	GENERAL (1000/15m)	`routes/config-drift.js:39`
POST	`/api/v1/polling`	protected	GENERAL (1000/15m)	`routes/config-drift.js:66`
GET	`/api/v1/report`	protected	GENERAL (1000/15m)	`routes/config-drift.js:30`

Licensing

4 routes

Method	Full path	Auth	Rate limit	Defined in
POST	`/api/v1/license/activate`	protected	GENERAL (1000/15m)	`routes/license.js:16`
POST	`/api/v1/license/deactivate`	protected	GENERAL (1000/15m)	`routes/license.js:41`
GET	`/api/v1/license/feature/:feature`	public	GENERAL (1000/15m)	`routes/license.js:52`
GET	`/api/v1/license/status`	public	GENERAL (1000/15m)	`routes/license.js:35`

File browser

3 routes

Method	Full path	Auth	Rate limit	Defined in
GET	`/api/v1/browse/directories`	protected	GENERAL (1000/15m)	`routes/browse.js:52`
GET	`/api/v1/browse/roots`	protected	GENERAL (1000/15m)	`routes/browse.js:34`
GET	`/api/v1/media/detected-mounts`	protected	GENERAL (1000/15m)	`routes/browse.js:137`

Theming

3 routes

Method	Full path	Auth	Rate limit	Defined in
GET	`/api/v1/themes`	public	GENERAL (1000/15m)	`routes/themes.js:40`
DELETE	`/api/v1/themes/:slug`	protected	GENERAL (1000/15m)	`routes/themes.js:65`
POST	`/api/v1/themes/:slug`	protected	GENERAL (1000/15m)	`routes/themes.js:45`

Service credentials

2 routes

Method	Full path	Auth	Rate limit	Defined in
GET	`/api/v1/credentials/list`	protected	GENERAL (1000/15m)	`routes/credentials.js:15`
POST	`/api/v1/credentials/rotate-key`	protected	GENERAL (1000/15m)	`routes/credentials.js:21`

Events

2 routes

Method	Full path	Auth	Rate limit	Defined in
GET	`/api/v1/events/clients`	protected	GENERAL (1000/15m)	`routes/events.js:154`
GET	`/api/v1/events/stream`	protected	GENERAL (1000/15m)	`routes/events.js:126`

Internal helpers

1 routes

Method	Full path	Auth	Rate limit	Defined in
GET	`/api/v1/status`	protected	GENERAL (1000/15m)	`routes/context.js:8`

Mount Point Map

How src/app.js wires route files to URL prefixes (via apiRouter.use):

Route file(s)	Mounted at
`routes/ca`	`/api/v1/ca`
`routes/containers`	`/api/v1/containers`
`routes/dependencies`	`/api/v1/dependencies`
`routes/dns`	`/api/v1/dns`
`routes/docker-resources`	`/api/v1/docker`
`routes/events`	`/api/v1/events`
`routes/license`	`/api/v1/license`
`routes/notifications`	`/api/v1/notifications`
`routes/openclaw`	`/api/v1/openclaw`
`routes/recipes/`	`/api/v1/recipes`
`routes/tailscale`	`/api/v1/tailscale`
`routes/tailscale-admin`	`/api/v1/tailscale`
`routes/workflows`	`/api/v1/workflows`
`routes/auth/`	`/api/v1 (root)`
`routes/config/`	`/api/v1 (root)`
`routes/services`	`/api/v1 (root)`
`routes/health`	`/api/v1 (root)`
`routes/monitoring`	`/api/v1 (root)`
`routes/updates`	`/api/v1 (root)`
`routes/sites`	`/api/v1 (root)`
`routes/credentials`	`/api/v1 (root)`
`routes/arr/`	`/api/v1 (root)`
`routes/apps/`	`/api/v1 (root)`
`routes/logs`	`/api/v1 (root)`
`routes/backups`	`/api/v1 (root)`
`routes/browse`	`/api/v1 (root)`
`routes/errorlogs`	`/api/v1 (root)`
`routes/themes`	`/api/v1 (root)`
`routes/auto-restart`	`/api/v1 (root)`
`routes/config-drift`	`/api/v1 (root)`
`routes/ssl-monitor`	`/api/v1 (root)`

PUBLIC_ROUTES Allowlist

Source: src/utilities/middleware.js:310-364 (42 entries)

Method	Path	Match
ANY	`/health`	exact
ANY	`/health/live`	exact
ANY	`/health/ready`	exact
ANY	`/healthz`	exact
ANY	`/readyz`	exact
ANY	`/probe/`	prefix
ANY	`/api/v1/tailscale/`	prefix
ANY	`/api/v1/totp/config`	exact
ANY	`/api/v1/totp/recovery-info`	exact
ANY	`/api/v1/totp/verify`	exact
ANY	`/api/v1/totp/setup`	exact
ANY	`/api/v1/totp/verify-setup`	exact
ANY	`/api/v1/totp/check-session`	exact
ANY	`/api/v1/auth/gate/`	prefix
ANY	`/api/v1/auth/app-token/`	prefix
ANY	`/api/v1/auth/login-page`	exact
ANY	`/api/v1/services`	exact
ANY	`/api/v1/ca/info`	exact
ANY	`/api/v1/ca/root.crt`	exact
ANY	`/api/v1/ca/install-script`	exact
ANY	`/api/v1/health/ca`	exact
GET	`/api/v1/ca/cert/`	prefix
ANY	`/api/v1/ca/certs`	exact
ANY	`/api/v1/csrf-token`	exact
ANY	`/api/v1/logo`	exact
ANY	`/api/v1/favicon`	exact
ANY	`/api/v1/themes`	exact
ANY	`/api/v1/license/status`	exact
GET	`/api/v1/license/feature/`	prefix
ANY	`/api/v1/config`	exact
ANY	`/api/v1/services/status`	exact
ANY	`/api/v1/health-checks/status`	exact
ANY	`/api/v1/monitoring/stats`	exact
ANY	`/api/v1/system/version`	exact
ANY	`/api/v1/system/update-status`	exact
ANY	`/api/v1/system/update-history`	exact
ANY	`/api/v1/system/update-check`	exact
ANY	`/api/v1/updates/available`	exact
ANY	`/api/v1/system/update-notify`	exact
ANY	`/api/v1/monitoring/stats`	exact
ANY	`/api/v1/health-checks/status`	exact
ANY	`/api/v1/version`	exact

Root-Level Endpoints (defined directly in src/app.js)

Method	Path	Auth	Purpose
GET	`/health`	public	Liveness (alias for `/health/live`)
GET	`/health/live`	public	Process-only check, no I/O
GET	`/health/ready`	public	Checks config + services + Docker + Caddy-admin (3s timeout each)
GET	`/healthz`	public	k8s alias for `/health/live`
GET	`/readyz`	public	k8s alias for `/health/ready`
GET	`/probe/:id`	public	Per-service health probe, sets `X-DashCaddy-HealthCheck: 1`
GET	`/api/v1/network/ips`	protected	Detected network interfaces + IPs (cached)
GET	`/api/v1/docs`	protected	Interactive Swagger UI
GET	`/api/v1/docs/spec`	protected	Raw OpenAPI 3.0.3 spec
GET	`/api/v1/version`	public (per PUBLIC_ROUTES)	API version

OpenAPI Spec Cross-Check

Routes defined in code: 236
Paths in openapi.yaml: 112

In code but NOT documented in OpenAPI (142)

/api/v1/:appId
/api/v1/:appId/backup-points
/api/v1/:appId/restore
/api/v1/:appId/revert/:filename
/api/v1/:recipeId
/api/v1/:recipeId/restart
/api/v1/:recipeId/start
/api/v1/:recipeId/stop
/api/v1/arr/quality-profiles
/api/v1/audit-logs
/api/v1/auth/jwt
/api/v1/auth/keys
/api/v1/auth/keys/:keyId
/api/v1/auth/login-page
/api/v1/backups/backup/:appId
/api/v1/backups/compare/:filename
/api/v1/backups/credentials/:provider
/api/v1/backups/files
/api/v1/backups/files/:appId
/api/v1/backups/restore-file/:filename
/api/v1/backups/schedule
/api/v1/backups/schedule/:appId
/api/v1/backups/storage-info
/api/v1/backups/test-destination
/api/v1/browse/directories
/api/v1/ca/cert/:domain
/api/v1/ca/certs
/api/v1/ca/info
/api/v1/ca/install-script
/api/v1/ca/root.crt
... and 112 more

Documented but NOT in code (18)

/api/v1/apps/:appId
/api/v1/apps/check-existing
/api/v1/apps/check-port/:port
/api/v1/apps/deploy
/api/v1/apps/suggest-port/:basePort
/api/v1/apps/templates
/api/v1/apps/templates/:appId
/api/v1/apps/update-subdomain
/api/v1/audit-log
/api/v1/browse/dir
/api/v1/caddy/get-cas
/api/v1/health
/api/v1/health-check/configure/:serviceId
/api/v1/health-check/incidents
/api/v1/health-check/incidents/history
/api/v1/health-check/stats/:serviceId
/api/v1/health-check/status
/api/v1/service-creds/:serviceId

38 KiB Raw Blame History

DashCaddy API Surface

Auth & Rate Limit Model

Summary by Area

App catalog

Tailscale

Backups

DNS

Monitoring

Updates

Authentication

Logs

Configuration

Health

Services

Containers (lifecycle)

Core / system

Dependencies

Notifications

App recipes

Docker resources

Caddy / sites

Updates / workflows

Auto-restart

Certificate authority

OpenClaw integration

Config drift

Licensing

File browser

Theming

Service credentials

Events

Internal helpers

Mount Point Map

PUBLIC_ROUTES Allowlist

Root-Level Endpoints (defined directly in src/app.js)

OpenAPI Spec Cross-Check

In code but NOT documented in OpenAPI (142)

Documented but NOT in code (18)

38 KiB

Raw Blame History