Endpoint Registry — All API Routes

Complete inventory of all HTTP endpoints exposed by Granit framework modules.

Tip

Use this page to verify that your frontend API client matches the backend routes. The OpenAPI schema (available at /openapi/v1.json) is the authoritative source for request/response types — this page focuses on routes, methods, and permissions.

Conventions

• Route prefixes are relative — each module defines a short prefix (e.g., "templates", "blobs", "identity/users") via its *EndpointsOptions class. The application composes the full path by mounting modules under a versioned group:

// Application startup (e.g., Program.cs)
RouteGroupBuilder api = app.MapGroup("api/v{version:apiVersion}");

api.MapGranitBlobStorageEndpoints();   // → /api/v1/blobs/...
api.MapGranitTemplatingEndpoints();    // → /api/v1/templates/...
api.MapGranitIdentityEndpoints();      // → /api/v1/identity/users/...

• Permissions: follow [Group].[Resource].[Action] (three segments)
• Error responses: all endpoints return RFC 7807 Problem Details on errors
• Query endpoints (MapQueryEndpoints<T>) are registered by the application, not the framework — the route pattern is app-defined
• Routes below show only the module-relative path (without the app prefix)

---

Authentication & API Keys

Module: Granit.Authentication.ApiKeys.Endpoints Prefix: api-keys

Method	Route	Operation	Permission
GET	/	ListApiKeys	ApiKeys.Keys.Read
GET	/{id:guid}	GetApiKeyById	ApiKeys.Keys.Read
POST	/	CreateApiKey	ApiKeys.Keys.Create
POST	/{id:guid}/revoke	RevokeApiKey	ApiKeys.Keys.Revoke
POST	/{id:guid}/rotate	RotateApiKey	ApiKeys.Keys.Rotate
PUT	/{id:guid}/scopes	UpdateApiKeyScopes	ApiKeys.Keys.UpdateScopes

---

Authorization

Module: Granit.Authorization.Endpoints Prefix: auth

Method	Route	Operation	Permission
GET	/me	GetMyPermissions	Authenticated
GET	/definitions	GetPermissionDefinitions	Admin
GET	/roles/{roleName}	GetRolePermissions	Admin
PUT	/roles/{roleName}/{permissionName}	GrantPermission	Admin
DELETE	/roles/{roleName}/{permissionName}	RevokePermission	Admin

---

Background Jobs

Module: Granit.BackgroundJobs.Endpoints Prefix: background-jobs

Method	Route	Operation	Permission
GET	/	GetAllBackgroundJobs	BackgroundJobs.Jobs.Manage
GET	/{name}	GetBackgroundJobByName	BackgroundJobs.Jobs.Manage
POST	/{name}/pause	PauseBackgroundJob	BackgroundJobs.Jobs.Manage
POST	/{name}/resume	ResumeBackgroundJob	BackgroundJobs.Jobs.Manage
POST	/{name}/trigger	TriggerBackgroundJob	BackgroundJobs.Jobs.Manage

---

Blob Storage

Module: Granit.BlobStorage.Endpoints Prefix: blobs

Method	Route	Operation	Permission
GET	/{id:guid}	GetBlobDescriptor	BlobStorage.Blobs.Manage
POST	/upload	InitiateBlobUpload	BlobStorage.Blobs.Manage
POST	/{id:guid}/confirm	ConfirmBlobUpload	BlobStorage.Blobs.Manage
POST	/{id:guid}/download-url	GenerateBlobDownloadUrl	BlobStorage.Blobs.Manage
DELETE	/{id:guid}	DeleteBlob	BlobStorage.Blobs.Manage
POST	/cleanup-orphans	CleanupOrphanedBlobs	BlobStorage.Blobs.Manage

Blob Proxy

Module: Granit.BlobStorage.Proxy Prefix: blobs/proxy

Method	Route	Operation	Auth
PUT	/upload/{token}	BlobProxyUpload	Token-based
GET	/download/{token}	BlobProxyDownload	Token-based

---

Cookie Consent

Module: Granit.Http.Cookies.Endpoints Prefix: (root — mounted directly on the app group)

Method	Route	Operation	Auth
GET	/cookies/config	GetCookieConsentConfig	Anonymous

---

Data Exchange

Module: Granit.DataExchange.Endpoints Prefix: data-exchange

Import

Method	Route	Operation	Permission
GET	/jobs	ListImportJobs	DataExchange.Import.*
POST	/	CreateImportJob	DataExchange.Import.*
POST	/{jobId}/preview	PreviewImportJob	DataExchange.Import.*
PUT	/{jobId}/mappings	ConfirmImportMappings	DataExchange.Import.*
POST	/{jobId}/execute	ExecuteImportJob	DataExchange.Import.*
POST	/{jobId}/dry-run	DryRunImportJob	DataExchange.Import.*
GET	/{jobId}	GetImportJob	DataExchange.Import.*
DELETE	/{jobId}	DeleteImportJob	DataExchange.Import.*
GET	/{jobId}/report	GetImportReport	DataExchange.Import.*
GET	/{jobId}/correction-file	DownloadImportCorrectionFile	DataExchange.Import.*

Export

Method	Route	Operation	Permission
GET	/export/jobs	ListExportJobs	DataExchange.Export.*
POST	/export/jobs	CreateExportJob	DataExchange.Export.*
GET	/export/jobs/{id}	GetExportJob	DataExchange.Export.*
GET	/export/jobs/{id}/download	DownloadExportFile	DataExchange.Export.*

Metadata

Method	Route	Operation	Permission
GET	/metadata/definitions	GetExportDefinitions	DataExchange.Export.*
GET	/metadata/definitions/{name}/fields	GetExportDefinitionFields	DataExchange.Export.*
GET	/metadata/presets/{definitionName}	ListExportPresets	DataExchange.Export.*
POST	/metadata/presets	SaveExportPreset	DataExchange.Export.*
DELETE	/metadata/presets/{definitionName}/{presetName}	DeleteExportPreset	DataExchange.Export.*

---

Features

Module: Granit.Features.Endpoints Prefix: features

Method	Route	Operation	Permission
GET	/definitions	GetFeatureDefinitions	Features.Flags.Read
GET	/values	GetAllFeatureValues	Authenticated
GET	/values/{name}	GetFeatureValue	Authenticated
PUT	/overrides/{name}	SetFeatureOverride	Features.Flags.Manage
DELETE	/overrides/{name}	DeleteFeatureOverride	Features.Flags.Manage

---

Identity

Identity uses two separate endpoint groups with distinct prefixes.

User Cache (identity/users)

Module: Granit.Identity.Endpoints — MapGranitIdentityEndpoints() Prefix: identity/users

Method	Route	Operation	Permission
GET	/	SearchIdentityUsers	Identity.UserCache.Read
GET	/{userId}	GetIdentityUser	Identity.UserCache.Read
POST	/batch	BatchResolveIdentityUsers	Identity.UserCache.Read
GET	/stats	GetIdentityUserCacheStats	Identity.UserCache.Read
GET	/capabilities	GetCapabilities	Identity.UserCache.Read
POST	/sync	SyncIdentityUsers	Identity.UserCache.Sync
POST	/sync-all	SyncAllIdentityUsers	Identity.UserCache.Sync
POST	/sync-stale	SyncStaleIdentityUsers	Identity.UserCache.Sync
DELETE	/{userId}	EraseIdentityUserData	Identity.UserCache.Delete

Identity Provider (identity/provider)

Module: Granit.Identity.Endpoints — MapGranitIdentityProviderEndpoints() Prefix: identity/provider

Users

Method	Route	Operation	Permission
GET	/users	ListProviderUsers	Identity.Users.Read
GET	/users/{userId}	GetProviderUser	Identity.Users.Read
POST	/users	CreateProviderUser	Identity.Users.Manage
PUT	/users/{userId}	UpdateProviderUser	Identity.Users.Manage

Roles

Method	Route	Operation	Permission
GET	/roles	ListProviderRoles	Identity.Roles.Read
GET	/roles/{roleName}/members	GetRoleMembers	Identity.Roles.Read
GET	/users/{userId}/roles	GetUserRoles	Identity.Roles.Read
PUT	/users/{userId}/roles/{roleName}	AssignUserRole	Identity.Roles.Manage
DELETE	/users/{userId}/roles/{roleName}	RemoveUserRole	Identity.Roles.Manage

Groups

Method	Route	Operation	Permission
GET	/groups	ListProviderGroups	Identity.Groups.Read
GET	/users/{userId}/groups	GetUserGroups	Identity.Groups.Read
PUT	/users/{userId}/groups/{groupId}	AddUserToGroup	Identity.Groups.Manage
DELETE	/users/{userId}/groups/{groupId}	RemoveUserFromGroup	Identity.Groups.Manage

Sessions & Devices

Method	Route	Operation	Permission
GET	/users/{userId}/sessions	ListUserSessions	Identity.Sessions.Read
DELETE	/users/{userId}/sessions/{sessionId}	TerminateSession	Identity.Sessions.Manage
DELETE	/users/{userId}/sessions	TerminateAllSessions	Identity.Sessions.Manage
GET	/users/{userId}/devices	GetUserDeviceActivity	Identity.Sessions.Read

Passwords

Method	Route	Operation	Permission
GET	/users/{userId}/password/changed-at	GetPasswordChangedAt	Identity.Passwords.Read
POST	/users/{userId}/password/reset-email	SendPasswordResetEmail	Identity.Passwords.Manage
POST	/users/{userId}/password/temporary	SetTemporaryPassword	Identity.Passwords.Manage

Webhook

Method	Route	Operation	Auth
POST	/webhook	IdentityWebhook	Signature-validated

---

Localization

Module: Granit.Localization.Endpoints Prefix: (root — mounted directly on the app group)

Method	Route	Operation	Permission
GET	/localization	GetGranitLocalization	Anonymous
GET	/localization/overrides	GetLocalizationOverrides	Localization.Overrides.Manage
PUT	/localization/overrides/{resourceName}/{cultureName}/{key}	PutLocalizationOverride	Localization.Overrides.Manage
DELETE	/localization/overrides/{resourceName}/{cultureName}/{key}	DeleteLocalizationOverride	Localization.Overrides.Manage

---

Notifications

Module: Granit.Notifications.Endpoints Prefix: notifications

Inbox

Method	Route	Operation	Auth
GET	/	GetNotifications	Authenticated
GET	/unread/count	GetUnreadCount	Authenticated
POST	/{id:guid}/read	MarkAsRead	Authenticated
POST	/read-all	MarkAllAsRead	Authenticated

Activity Feed

Method	Route	Operation	Auth
GET	/entity/{entityType}/{entityId}	GetEntityActivityFeed	Authenticated

Preferences & Subscriptions

Method	Route	Operation	Auth
GET	/preferences	GetPreferences	Authenticated
PUT	/preferences	UpdatePreference	Authenticated
GET	/types	GetNotificationTypes	Authenticated
GET	/subscriptions	GetSubscriptions	Authenticated
POST	/subscriptions/{typeName}	Subscribe	Authenticated
DELETE	/subscriptions/{typeName}	Unsubscribe	Authenticated

Entity Followers

Method	Route	Operation	Auth
POST	/entity/{entityType}/{entityId}/follow	FollowEntity	Authenticated
DELETE	/entity/{entityType}/{entityId}/follow	UnfollowEntity	Authenticated
GET	/entity/{entityType}/{entityId}/followers	GetEntityFollowers	Authenticated

---

OpenIddict

OpenIddict uses two endpoint groups: account self-service (anonymous + authenticated) and admin management (permission-protected).

Account Self-Service (account)

Module: Granit.OpenIddict.Endpoints — MapOpenIddictEndpoints() Prefix: account

Registration & Email

Method	Route	Operation	Auth
POST	/register	RegisterAccount	Anonymous
GET	/confirm-email	ConfirmEmail	Anonymous
POST	/resend-confirmation-email	ResendConfirmationEmail	Authenticated

Profile

Method	Route	Operation	Auth
GET	/profile	GetAccountProfile	Authenticated
PUT	/profile	UpdateAccountProfile	Authenticated

Password

Method	Route	Operation	Auth
POST	/change-password	ChangePassword	Authenticated
POST	/forgot-password	ForgotPassword	Anonymous
POST	/reset-password	ResetPassword	Anonymous

Two-Factor Authentication

Method	Route	Operation	Auth
GET	/two-factor	GetTwoFactorStatus	Authenticated
GET	/two-factor/authenticator-key	GetAuthenticatorKey	Authenticated
POST	/two-factor/enable	EnableTwoFactor	Authenticated
POST	/two-factor/disable	DisableTwoFactor	Authenticated
POST	/two-factor/recovery-codes	GenerateRecoveryCodes	Authenticated

External Logins

Method	Route	Operation	Auth
GET	/external-logins	ListExternalLogins	Authenticated
POST	/external-logins/challenge/{provider}	ChallengeExternalLogin	Anonymous
GET	/external-logins/callback	ExternalLoginCallback	Anonymous
DELETE	/external-logins/{provider}	UnlinkExternalLogin	Authenticated

Passkeys (WebAuthn)

Method	Route	Operation	Auth
GET	/passkeys	ListPasskeys	Authenticated
POST	/passkeys/register/begin	BeginPasskeyRegistration	Authenticated
POST	/passkeys/register/complete	CompletePasskeyRegistration	Authenticated
POST	/passkeys/assertion/begin	BeginPasskeyAssertion	Anonymous
PATCH	/passkeys/{id}	RenamePasskey	Authenticated
DELETE	/passkeys/{id}	DeletePasskey	Authenticated

Account & Session

Method	Route	Operation	Auth
POST	/delete	DeleteAccount	Authenticated
POST	/session/heartbeat	SessionHeartbeat	Authenticated
POST	/session/back-to-impersonator	BackToImpersonator	Authenticated

Admin Management (admin)

Module: Granit.OpenIddict.Endpoints — MapOpenIddictEndpoints() Prefix: admin

Users

Method	Route	Operation	Permission
GET	/users	ListUsers	OpenIddict.Users.Read
GET	/users/{userId}	GetUser	OpenIddict.Users.Read
POST	/users	CreateUser	OpenIddict.Users.Create
DELETE	/users/{userId}	DeleteUser	OpenIddict.Users.Delete
POST	/users/{userId}/impersonate	ImpersonateUser	OpenIddict.Users.Impersonate

Roles

Method	Route	Operation	Permission
GET	/roles	ListRoles	OpenIddict.Roles.Read
POST	/roles	CreateRole	OpenIddict.Roles.Create
DELETE	/roles/{roleName}	DeleteRole	OpenIddict.Roles.Delete
GET	/roles/{roleName}/members	GetRoleMembers	OpenIddict.Roles.Read

Groups

Method	Route	Operation	Permission
GET	/groups	ListGroups	OpenIddict.Groups.Read
POST	/groups	CreateGroup	OpenIddict.Groups.Create
DELETE	/groups/{groupId}	DeleteGroup	OpenIddict.Groups.Delete
POST	/groups/{groupId}/members	AddGroupMember	OpenIddict.Groups.Manage
DELETE	/groups/{groupId}/members/{userId}	RemoveGroupMember	OpenIddict.Groups.Manage

OIDC Applications

Method	Route	Operation	Permission	Response
GET	/oidc/applications	ListOidcApplications	OpenIddict.Applications.Read	OidcApplicationResponse[]
POST	/oidc/applications	CreateOidcApplication	OpenIddict.Applications.Create	201 / 409
DELETE	/oidc/applications/{clientId}	DeleteOidcApplication	OpenIddict.Applications.Delete	204 / 404
POST	/oidc/applications/{clientId}/rotate-secret	RotateOidcApplicationSecret	OpenIddict.Applications.Rotate	OidcSecretRotationResponse / 404

Response types:

interface OidcApplicationResponse {
  id: string;
  clientId: string;
  displayName: string;
  type: string; // "public" | "confidential"
}

interface OidcSecretRotationResponse {
  clientId: string;
  newSecret: string; // ⚠ Shown ONCE — display in a copyable modal
}

OIDC Scopes

Method	Route	Operation	Permission	Response
GET	/oidc/scopes	ListOidcScopes	OpenIddict.Scopes.Read	OidcScopeResponse[]
POST	/oidc/scopes	CreateOidcScope	OpenIddict.Scopes.Create	201 / 409
DELETE	/oidc/scopes/{scopeName}	DeleteOidcScope	OpenIddict.Scopes.Delete	204 / 404

interface OidcScopeResponse {
  id: string;
  name: string;
  displayName: string;
}

OIDC Authorizations

Method	Route	Operation	Permission	Response
GET	/oidc/authorizations	ListOidcAuthorizations	OpenIddict.Authorizations.Read	OidcAuthorizationResponse[]
DELETE	/oidc/authorizations/{id}	RevokeOidcAuthorization	OpenIddict.Authorizations.Revoke	204 / 404
DELETE	/oidc/authorizations/user/{userId}	RevokeUserOidcAuthorizations	OpenIddict.Authorizations.Revoke	204

interface OidcAuthorizationResponse {
  id: string;
  subject: string; // userId
  status: string;  // "valid" | "revoked"
  type: string;    // "permanent" | "ad-hoc"
}

---

Privacy (GDPR)

Module: Granit.Privacy.Endpoints Prefix: privacy

Data Export (Art. 15/20)

Method	Route	Operation	Permission
POST	/export	RequestPrivacyExport	Privacy.Export.Execute
GET	/export/{requestId}	GetPrivacyExportStatus	Privacy.Export.Read
GET	/export	ListPrivacyExports	Privacy.Export.Read

Data Deletion (Art. 17)

Method	Route	Operation	Permission
POST	/deletion	RequestPrivacyDeletion	Privacy.Deletion.Execute
POST	/deletion/{requestId}/cancel	CancelPrivacyDeletion	Privacy.Deletion.Execute
GET	/deletion/{requestId}	GetPrivacyDeletionStatus	Privacy.Deletion.Execute
GET	/deletion	ListPrivacyDeletions	Privacy.Deletion.Execute

Legal Agreements (Art. 7)

Method	Route	Operation	Permission
GET	/agreements/documents	ListPrivacyLegalDocuments	Privacy.Agreements.Read
GET	/agreements/status	GetPrivacyConsentStatus	Privacy.Agreements.Read
GET	/agreements/history	ListPrivacyAgreementHistory	Privacy.Agreements.Read
POST	/agreements/accept	AcceptPrivacyAgreement	Privacy.Agreements.Create

---

QueryEngine

Module: Granit.QueryEngine.Endpoints Prefix: app-defined via MapQueryEndpoints<T>(pattern)

Caution

QueryEngine endpoints are registered by the application, not the framework. The route pattern is passed to MapQueryEndpoints<T>(). For consistency, use the same prefix as the module’s CRUD endpoints (e.g., /localization/overrides).

Method	Route	Operation
GET	/{pattern}	Query{EntityName}
GET	/{pattern}/meta	Get{EntityName}Meta
GET	/{pattern}/saved-views	GetSavedViews
POST	/{pattern}/saved-views	CreateSavedView
PUT	/{pattern}/saved-views/{id}	UpdateSavedView
DELETE	/{pattern}/saved-views/{id}	DeleteSavedView
POST	/{pattern}/saved-views/{id}/set-default	SetDefaultSavedView

---

Settings

Module: Granit.Settings.Endpoints Prefix: settings

Method	Route	Operation	Permission
GET	/user	GetAllUserSettings	Authenticated
GET	/user/{name}	GetUserSetting	Authenticated
PUT	/user/{name}	UpdateUserSetting	Authenticated
DELETE	/user/{name}	DeleteUserSetting	Authenticated
GET	/tenant	GetAllTenantSettings	Settings.Tenant.Read
PUT	/tenant/{name}	UpdateTenantSetting	Settings.Tenant.Manage
GET	/global	GetAllGlobalSettings	Settings.Global.Read
PUT	/global/{name}	UpdateGlobalSetting	Settings.Global.Manage

---

Templating

Module: Granit.Templating.Endpoints Prefix: templates

Templates

Method	Route	Operation	Permission
GET	/	ListTemplates	Templates.Templates.Manage
GET	/{name}	GetTemplateDetail	Templates.Templates.Manage
POST	/	CreateTemplateDraft	Templates.Templates.Manage
PUT	/{name}	UpdateTemplateDraft	Templates.Templates.Manage
DELETE	/{name}/draft	DeleteTemplateDraft	Templates.Templates.Manage
POST	/{name}/publish	PublishTemplate	Templates.Templates.Manage
POST	/{name}/unpublish	UnpublishTemplate	Templates.Templates.Manage
GET	/{name}/lifecycle	GetTemplateLifecycle	Templates.Templates.Manage
POST	/{name}/preview	PreviewTemplate	Templates.Templates.Manage
GET	/{name}/variables	GetTemplateVariables	Templates.Templates.Manage
GET	/{name}/history	GetTemplateHistory	Templates.Templates.Manage
GET	/{name}/history/{revisionId:guid}	GetTemplateRevisionDetail	Templates.Templates.Manage

Categories

Method	Route	Operation	Permission
GET	/categories	ListTemplateCategories	Templates.Templates.Manage
POST	/categories	CreateTemplateCategory	Templates.Templates.Manage
PUT	/categories/{id}	UpdateTemplateCategory	Templates.Templates.Manage
DELETE	/categories/{id}	DeleteTemplateCategory	Templates.Templates.Manage

---

Timeline

Module: Granit.Timeline.Endpoints Prefix: timeline

Method	Route	Operation	Permission
GET	/{entityType}/{entityId}/history	GetEntityStream	Timeline.Entries.Read
POST	/{entityType}/{entityId}/entries	PostTimelineEntry	Timeline.Entries.Read
DELETE	/{entityType}/{entityId}/entries/{id}	DeleteTimelineEntry	Timeline.Entries.Read

---

Validation

Module: Granit.Validation.Endpoints Prefix: validation

Method	Route	Operation	Auth
POST	/validate	ValidateField	Anonymous
POST	/validate-batch	ValidateFieldBatch	Anonymous
GET	/validators	GetRegisteredValidators	Anonymous

---

Webhooks

Module: Granit.Webhooks.Endpoints Prefix: webhooks

Module Config

Method	Route	Operation	Permission
GET	/config	GetWebhooksConfig	Webhooks.Subscriptions.Manage

Event Types

Method	Route	Operation	Permission
GET	/event-types	GetWebhookEventTypes	Webhooks.Subscriptions.Manage

Subscriptions — CRUD

Method	Route	Operation	Permission
GET	/subscriptions/{id}	GetWebhookSubscription	Webhooks.Subscriptions.Manage
POST	/subscriptions	CreateWebhookSubscription	Webhooks.Subscriptions.Manage
PUT	/subscriptions/{id}	UpdateWebhookSubscription	Webhooks.Subscriptions.Manage
DELETE	/subscriptions/{id}	DeleteWebhookSubscription	Webhooks.Subscriptions.Manage

Subscriptions — Lifecycle

Method	Route	Operation	Permission
POST	/subscriptions/{id}/activate	ActivateWebhookSubscription	Webhooks.Subscriptions.Manage
POST	/subscriptions/{id}/suspend	SuspendWebhookSubscription	Webhooks.Subscriptions.Manage
POST	/subscriptions/{id}/deactivate	DeactivateWebhookSubscription	Webhooks.Subscriptions.Manage

Subscriptions — Operations

Method	Route	Operation	Permission
POST	/subscriptions/{id}/rotate-secret	RotateWebhookSecret	Webhooks.Subscriptions.Manage
POST	/subscriptions/{id}/test-ping	TestWebhookPing	Webhooks.Subscriptions.Manage

Statistics & Deliveries

Method	Route	Operation	Permission
GET	/stats	GetWebhookStats	Webhooks.Subscriptions.Manage
GET	/deliveries/query	QueryWebhookDeliveries	Webhooks.Subscriptions.Manage
POST	/deliveries/{deliveryId}/retry	RetryWebhookDelivery	Webhooks.Subscriptions.Manage

---

Workflow

Module: Granit.Workflow.Endpoints Prefix: workflow

Method	Route	Operation	Permission
GET	/{entityType}/{entityId}/history	GetTransitionHistory	Workflow.History
GET	/transitions	GetAvailableTransitions	Workflow.History
POST	/transitions	ExecuteTransition	Workflow.History

---

AI

Module: Granit.AI.Endpoints Prefix: ai

Workspaces (Admin)

Method	Route	Operation	Permission
GET	/workspaces	ListAIWorkspaces	AI.Workspaces.*
GET	/workspaces/{name}	GetAIWorkspace	AI.Workspaces.*
POST	/workspaces	CreateAIWorkspace	AI.Workspaces.*
PUT	/workspaces/{name}	UpdateAIWorkspace	AI.Workspaces.*
DELETE	/workspaces/{name}	DeleteAIWorkspace	AI.Workspaces.*

Chat & Embeddings

Method	Route	Operation	Permission
POST	/chat/{workspaceName}	CreateChatCompletion	AI.Chat.Execute
POST	/chat/{workspaceName}/stream	StreamChatCompletion	AI.Chat.Execute
POST	/embeddings/{workspaceName}	GenerateEmbedding	AI.Embedding.Generate

---

Audit Log

Module: Granit.Auditing.Endpoints Prefix: audit-log

Method	Route	Operation	Permission
GET	/	GetAuditEntries	Auditing.AuditEntries.Read
GET	/{id:guid}	GetAuditEntryById	Auditing.AuditEntries.Read
GET	/entity/{entityType}/{entityId}	GetAuditEntriesByEntity	Auditing.AuditEntries.Read

---

Diagnostics

Module: Granit.Diagnostics.Endpoints Prefix: diagnostics

Method	Route	Operation	Auth
GET	/health	GetSystemHealth	Authenticated

---

Reference Data

Module: Granit.ReferenceData.Endpoints Prefix: reference-data

Caution

Reference Data endpoints are registered per entity type by the application via MapGranitReferenceDataEndpoints<T>(). Each entity gets its own sub-group under the prefix.

Method	Route	Operation	Permission
GET	/	GetReferenceDataList	Read
GET	/{code}	GetReferenceDataByCode	Read
POST	/	CreateReferenceData	Admin
PUT	/{code}	UpdateReferenceData	Admin
DELETE	/{code}	DeactivateReferenceData	Admin

---

Summary

Module	Endpoints	Auth model
API Keys	6	Permission-based
Audit Log	3	Permission-based
Authorization	5	Admin + Authenticated
Background Jobs	5	Permission-based
Blob Storage	6 + 2 proxy	Permission + Token
Cookie Consent	1	Anonymous
Data Exchange	19	Permission-based
Diagnostics	1	Authenticated
Features	5	Permission + Authenticated
Identity — Cache	9	Permission-based
Identity — Provider	18 + webhook	Permission-based
Localization	4	Anonymous + Permission
Notifications	14	Authenticated
Privacy (GDPR)	8	Permission-based
QueryEngine	7 per entity	App-defined
Reference Data	5 per entity	App-defined
Settings	8	Authenticated + Permission
Templating	16	Permission-based
Timeline	3	Permission-based
Validation	3	Anonymous
Webhooks	15	Permission-based
Workflow	3	Permission-based
AI	8	Permission-based
Total	~168+