{
  "routes": [
    {
      "method": "GET",
      "path": "/api/health",
      "auth": "none",
      "forwards_content": false,
      "what": "liveness, readiness and which adapters are bound"
    },
    {
      "method": "GET",
      "path": "/api/statement",
      "auth": "none",
      "forwards_content": false,
      "what": "the privacy statement, verbatim, as data"
    },
    {
      "method": "GET",
      "path": "/api/routes",
      "auth": "none",
      "forwards_content": false,
      "what": "this table"
    },
    {
      "method": "GET",
      "path": "/api/mail-states",
      "auth": "none",
      "forwards_content": false,
      "what": "every named outcome of a sign-in send"
    },
    {
      "method": "GET",
      "path": "/api/tones",
      "auth": "none",
      "forwards_content": false,
      "what": "the colour law: which states are teal, amber and red, and why"
    },
    {
      "method": "GET",
      "path": "/api/entitlement/states",
      "auth": "none",
      "forwards_content": false,
      "what": "ENTITLED / UNREACHABLE / REVOKED and the classifier contract"
    },
    {
      "method": "GET",
      "path": "/api/entitlement/policy",
      "auth": "none",
      "forwards_content": false,
      "what": "the sunset switch, and that its setting is the owner's"
    },
    {
      "method": "POST",
      "path": "/api/signin/request",
      "auth": "none",
      "forwards_content": false,
      "what": "email a six-digit code; returns a NAMED mail state"
    },
    {
      "method": "POST",
      "path": "/api/signin/verify",
      "auth": "none",
      "forwards_content": false,
      "what": "spend the code once; set the session cookie; issue a 24h token"
    },
    {
      "method": "POST",
      "path": "/api/signout",
      "auth": "session",
      "forwards_content": false,
      "what": "drop the session record and the cookie"
    },
    {
      "method": "GET",
      "path": "/api/me",
      "auth": "session",
      "forwards_content": false,
      "what": "the account and its entitlement state"
    },
    {
      "method": "GET",
      "path": "/api/pair",
      "auth": "session",
      "forwards_content": false,
      "what": "the pairing record: four fields"
    },
    {
      "method": "POST",
      "path": "/api/pair",
      "auth": "session",
      "forwards_content": false,
      "what": "store the four fields. The browser has already talked to the agent"
    },
    {
      "method": "DELETE",
      "path": "/api/pair",
      "auth": "session",
      "forwards_content": false,
      "what": "forget the machine, with a receipt and a verification probe"
    },
    {
      "method": "POST",
      "path": "/api/entitlement/issue",
      "auth": "session",
      "forwards_content": false,
      "what": "mint a fresh 24h token for the browser to hand to the agent"
    },
    {
      "method": "POST",
      "path": "/api/entitlement/checkin",
      "auth": "token",
      "forwards_content": false,
      "what": "the agent's check-in: ENTITLED or REVOKED, explicitly"
    },
    {
      "method": "POST",
      "path": "/api/entitlement/broker-check",
      "auth": "broker",
      "forwards_content": false,
      "what": "the authoritative answer the broker drops a path on"
    },
    {
      "method": "POST",
      "path": "/api/admin/revoke",
      "auth": "operator",
      "forwards_content": false,
      "what": "revoke an account by email, audited"
    },
    {
      "method": "POST",
      "path": "/api/admin/reinstate",
      "auth": "operator",
      "forwards_content": false,
      "what": "reinstate an account, audited as a new line"
    },
    {
      "method": "GET",
      "path": "/api/admin/audit",
      "auth": "operator",
      "forwards_content": false,
      "what": "the append-only record of every operator act"
    }
  ],
  "proxy_routes": [],
  "max_body_bytes": 4096,
  "law": "No route on this portal forwards session content, a model call or estate bytes. The browser talks directly to your own machine."
}