Internal endpoints
Reachable provider, scheduler, SDK, and operational routes excluded from the consumer contract.
These routes exist but are deliberately absent from the public OpenAPI paths. They are listed so operators do not have to reverse-engineer them. Their request formats may change without a public API version bump.
| Route | Why it is internal |
|---|---|
POST /api/webhooks/stripe | Raw, signature-verified Stripe settlement callback. |
POST /api/webhooks/razorpay | Raw, signature-verified Razorpay settlement callback. |
POST /api/webhooks/billplz | Raw form-encoded, signature-verified Billplz callback. |
POST /api/webhooks/razorpay_demo | Signed Razorpay simulator callback; never live money. |
POST /api/webhooks/tng_demo | Signed wallet simulator callback; never live money. |
GET /api/cron/ingest-listings | Secret-bearing scheduled source ingestion that can incur provider work. |
GET /api/cron/recheck-listings | Secret-bearing scheduled listing recheck. |
GET /api/auth/*, POST /api/auth/* | Better Auth SDK sign-in, callback, verification, and session internals. Use the first-party sign-in flow. |
GET /api/identity/dev-accounts | Local-only development account chooser. |
POST /api/identity/dev-sign-in | Local-only OTP capture and sign-in shortcut. |
POST /api/ai/chat | Privileged, provider-backed streaming AI operation rather than a stable Xperience domain contract. |
GET /api/flags | Operational feature-provider evaluation. |
GET /api/image | Allowlisted discovery image transform/fallback transport. |
GET /api/discovery/listings/{slug}/source | Counted outbound redirect; its 302, cookie, and source location are browser navigation, not a JSON consumer API. |
POST /api/blob/upload | Preserved Vercel Blob client-protocol transport. The API mints provider upload authority after configured ownership checks; the SDK callback payload is intentionally not a stable consumer domain contract. |
GET /mcp, POST /mcp, DELETE /mcp | MCP transport, enabled only by operator configuration. |
The optional HTTP MCP surface is deliberately public and read-only: health,
version, boolean feature flags, a fixed public-route search and the same public
OpenAPI document. It does not expose accounts, tenant records or mutations, and
an Authorization header does not grant additional capability. Host and Origin
checks protect against DNS rebinding; they are not user authentication. Any
future private tool must add its own authenticated actor and live scope checks.
GET /api/openapi, /openapi.json, and /docs are documentation delivery
surfaces, not privileged domain operations. They expose the same generated
document and do not expose webhook, scheduler, SDK, AI, flag, or MCP schemas.
Do not build consumer integrations against the internal routes above.