API routes

← Back to concept

Routes expose capabilities

Choose stable resource paths and preserve domain ownership behind them. Compose route registration at the application root; keep request interpretation and behavior with their owner.

Authentication comes from the verified application session. Never accept credentials in a public query string. Use the project's CSRF contract for authenticated mutations and preserve 401, 403, 404 and conflict semantics.

A route rename is a public contract change. Find consumers, update links and tests, and make any compatibility behavior explicit. Infrastructure failure must not masquerade as a missing resource.