# Routes registered in backend/cmd/server/main.go under /api/v1 that
# docs/openapi.yaml does not describe yet. Frozen on 2026-10-22 (#1120).
#
# THIS LIST MAY ONLY SHRINK. Document a route in docs/openapi.yaml and delete
# its line here; the coverage test fails if a listed route is documented or no
# longer registered. Never add a line to make a PR pass: document the route.
# Epic #1121 tracks emptying this file, one module at a time.
#
# Format: METHOD /path, as main.go spells it, without the /api/v1 prefix.
POST /activation/celebrated
GET /activation/state
POST /ai/assistant/query
POST /ai/audits/:id/report
POST /ai/emerging-risks
POST /ai/evidence/:id/analyze
POST /ai/risks/:id/treatment-plan
GET /ai/status
GET /analytics/dashboard
GET /analytics/executive
GET /analytics/export
PUT /analytics/financial/currency
GET /analytics/frameworks
GET /analytics/mitigations/metrics
GET /analytics/risks/metrics
GET /analytics/risks/trends
GET /assets/:id/inventories
POST /assets/import
GET /assets/statistics
GET /attack-surface/draft-risks
POST /attack-surface/draft-risks/review
GET /attack-surface/risk-rule
PUT /attack-surface/risk-rule
POST /attack-surface/risk-rule/preview
GET /audit-logs
GET /audit-logs/action/:action
GET /audit-logs/user/:user_id
GET /automation/channels
PUT /automation/channels
GET /automation/channels/catalogue
POST /automation/channels/test
GET /automation/dry-runs/:id
POST /automation/dry-runs/:id/cancel
GET /automation/executions
POST /automation/executions/:id/replay
GET /automation/rules
POST /automation/rules
DELETE /automation/rules/:id
GET /automation/rules/:id
PUT /automation/rules/:id
POST /automation/rules/:id/dry-run
POST /automation/rules/:id/enable
GET /automation/rules/:id/executions
POST /automation/rules/:id/run
POST /automation/rules/:id/suspend
GET /automation/sla
GET /automation/sla/stats
GET /automation/state
GET /automation/templates
POST /automation/templates/:key/adopt
GET /billing
POST /billing/cancel
POST /billing/change-plan
POST /billing/checkout
POST /billing/trial
GET /bulk-operations
POST /bulk-operations
GET /bulk-operations/:id
GET /compliance/frameworks/:frameworkId/inherited-coverage
POST /cti/match
GET /cti/stats
POST /cti/sync
GET /cti/threats
DELETE /cti/threats/:cve/dismissal
PUT /cti/threats/:cve/dismissal
GET /cti/vulnerabilities
GET /cti/vulnerabilities/:cve
GET /custom-fields
POST /custom-fields
DELETE /custom-fields/:id
GET /custom-fields/:id
PATCH /custom-fields/:id
GET /custom-fields/scope/:scope
POST /custom-fields/templates/:id/apply
GET /dashboard/complete
GET /dashboard/metrics
GET /dashboard/mitigation-progress
GET /dashboard/mitigation-status
GET /dashboard/risk-trends
GET /dashboard/severity-distribution
GET /dashboard/top-risks
GET /entities
GET /entities/:type/:id
GET /entities/:type/:id/audit
GET /entities/:type/:id/relations
GET /entitlements
GET /evidence
POST /evidence
DELETE /evidence/:evidenceId
GET /evidence/:evidenceId
PATCH /evidence/:evidenceId
GET /evidence/:evidenceId/download
POST /evidence/:evidenceId/links
DELETE /evidence/:evidenceId/links/:controlId
POST /evidence/:evidenceId/review
GET /evidence/missing
GET /governance/approvals
POST /governance/approvals
GET /governance/approvals/:id
POST /governance/approvals/:id/cancel
POST /governance/approvals/:id/decide
POST /governance/approvals/:id/defer
GET /governance/audit-events
GET /governance/audit-events/export
GET /governance/audit-events/verify
GET /governance/audit-retention
PUT /governance/audit-retention
POST /governance/audit-retention/apply
GET /governance/delegations
POST /governance/delegations
GET /governance/delegations/effective
POST /governance/delegations/:id/revoke
GET /governance/request-types
GET /governance/workflows
POST /governance/workflows
DELETE /governance/workflows/:id
PUT /governance/workflows/:id
GET /incidents
POST /incidents
DELETE /incidents/:id
GET /incidents/:id
PUT /incidents/:id
GET /incidents/:id/actions
POST /incidents/:id/actions
PUT /incidents/:id/actions/:actionId
GET /incidents/:id/post-mortem
PUT /incidents/:id/post-mortem
POST /incidents/:id/post-mortem/publish
POST /incidents/:id/risks/:riskId
GET /incidents/:id/timeline
GET /incidents/origins
GET /incidents/stats
POST /integrations/:id/test
POST /invitations/accept
GET /invitations/preview
GET /mitigations
GET /mitigations/events
DELETE /mitigations/:id
GET /mitigations/:id
PATCH /mitigations/:id/reorder-subactions
POST /mitigations/:id/sub-actions
DELETE /mitigations/:id/sub-actions/:aid
PATCH /mitigations/:id/sub-actions/:aid
POST /mitigations/:id/sub-actions/:aid/complete
POST /mitigations/:id/sub-actions/:aid/revert
PATCH /mitigations/:id/validate
GET /notifications
GET /notifications/email-policy
PUT /notifications/email-policy
DELETE /notifications/:notificationId
PATCH /notifications/:notificationId/read
GET /notifications/preferences
PATCH /notifications/preferences
PATCH /notifications/read-all
POST /notifications/test
GET /notifications/unread-count
POST /onboarding/complete
GET /onboarding/recognition
GET /onboarding/starter-risks
POST /onboarding/starter-risks
GET /onboarding/state
PUT /onboarding/steps/:step
GET /onboarding/suggestions
GET /organization/counts
GET /organization/deletion
POST /organization/deletion
POST /organization/deletion/cancel
GET /organization/export
GET /organization/invitations
POST /organization/invitations
DELETE /organization/invitations/:invitationId
POST /organization/invitations/:invitationId/resend
GET /organization/members
GET /organization/members/audit
GET /organization/members/:memberId
PUT /organization/members/:memberId/role
PUT /organization/members/:memberId/status
GET /ownership/assignable
GET /ownership/me
GET /posture
GET /rbac/business-roles
GET /rbac/roles
POST /rbac/roles
DELETE /rbac/roles/:role_id
GET /rbac/roles/:role_id
PATCH /rbac/roles/:role_id
DELETE /rbac/roles/:role_id/permissions
GET /rbac/roles/:role_id/permissions
POST /rbac/roles/:role_id/permissions
GET /rbac/tenants
POST /rbac/tenants
DELETE /rbac/tenants/:tenant_id
GET /rbac/tenants/:tenant_id
PATCH /rbac/tenants/:tenant_id
GET /rbac/tenants/:tenant_id/stats
GET /rbac/tenants/:tenant_id/users
GET /rbac/users
POST /rbac/users
GET /rbac/users/stats
DELETE /rbac/users/:user_id
GET /rbac/users/:user_id
GET /rbac/users/:user_id/permissions
PATCH /rbac/users/:user_id/role
GET /realtime/catalog
GET /realtime/events
GET /realtime/stats
GET /reports
POST /reports
GET /reports/jobs
POST /reports/jobs
GET /reports/jobs/:jobId
GET /reports/jobs/:jobId/download
DELETE /reports/:reportId
GET /reports/:reportId
POST /reports/:reportId/comments
GET /reports/:reportId/compare
GET /reports/:reportId/download
GET /reports/:reportId/progress
POST /reports/:reportId/transition
GET /reports/:reportId/verify
GET /reports/:reportId/versions
GET /reports/types
GET /risk-categories
POST /risk-categories
DELETE /risk-categories/:id
PATCH /risk-categories/:id
GET /risks/:id/control-mappings
POST /risks/:id/control-mappings
DELETE /risks/:id/control-mappings/:mappingId
GET /risks/:id/incidents
GET /risks/:id/mitigations
POST /risks/:id/review
GET /risks/:id/score-working
GET /risks/:id/timeline
GET /risks/:id/timeline/changes/:type
GET /risks/:id/timeline/score-changes
GET /risks/:id/timeline/since/:timestamp
GET /risks/:id/timeline/status-changes
GET /risks/:id/timeline/trend
POST /risks/:id/transition
GET /risks/:id/transitions
POST /risks/import
GET /risks/unmapped
POST /scanner/agent/heartbeat
POST /scanner/agent/inventory
POST /scanner/agent/push
GET /scanner/agents
DELETE /scanner/agents/:id
POST /scanner/agents/register
GET /scanner/agent/stream
GET /scanner/configs
POST /scanner/configs
DELETE /scanner/configs/:id
POST /scanner/configs/:id/registration-token
POST /scanner/configs/:id/scan
GET /scanner/events
GET /scanner/jobs
POST /scanner/jobs/:id/ignore
POST /scanner/jobs/:id/import
GET /scanner/jobs/:id/preview
POST /scanner/mitigations/auto-complete
GET /score
POST /score-engine/classify
POST /score-engine/compute
GET /score-engine/configs
POST /score-engine/configs
GET /score-engine/configs/:id
PUT /score-engine/configs/:id
GET /score-engine/matrix
GET /score-engine/metrics
GET /score/history
GET /score/model
POST /score/preview
GET /search
GET /stats/mitigation-metrics
GET /stats/risk-distribution
GET /stats/top-vulnerabilities
GET /status
GET /teams
POST /teams
DELETE /teams/:id
GET /teams/:id
PATCH /teams/:id
DELETE /teams/:id/members/:userId
POST /teams/:id/members/:userId
GET /telemetry
PUT /telemetry
GET /users
POST /users
GET /vulnerabilities
DELETE /vulnerabilities/:id
GET /vulnerabilities/:id
PUT /vulnerabilities/:id/asset
GET /vulnerabilities/:id/match-candidates
PATCH /vulnerabilities/:id/status
POST /vulnerabilities/:id/ticket
POST /vulnerabilities/ingest
GET /vulnerabilities/integrations
POST /vulnerabilities/integrations
DELETE /vulnerabilities/integrations/:id
GET /vulnerabilities/integrations/:id
POST /vulnerabilities/integrations/:id/pull
POST /vulnerabilities/scan
GET /vulnerabilities/stats
DELETE /vulnerabilities/ticketing
GET /vulnerabilities/ticketing
PUT /vulnerabilities/ticketing
GET /vulnerabilities/unassigned
POST /vulnerabilities/webhook/:source
GET /vulnerability-connectors
