Reference is built from the registered routes on every request — always in sync.
OpenID Connect discovery, userinfo, OAuth2 authorization, and the management REST API on the auth domain.
Auth: Public discovery endpoints need no auth; /api/v1/* requires Bearer token (Passport, auth:api).
| Method | Endpoint | Auth | Route name |
|---|---|---|---|
| GET | auth.wbbx.de/.well-known/oauth-authorization-server | — | auth.oauth.authorization_server |
| GET | auth.wbbx.de/.well-known/openid-configuration | — | auth.openid.configuration |
| GET | auth.wbbx.de/api/domains | — | auth.domains |
| GET | auth.wbbx.de/api/v1/admin/permissions | bearer | auth.api.v1.admin.permissions |
| GET | auth.wbbx.de/api/v1/admin/roles | bearer | auth.api.v1.admin.roles |
| GET | auth.wbbx.de/api/v1/admin/users/{id}/access | bearer | auth.api.v1.admin.users.access |
| POST | auth.wbbx.de/api/v1/admin/users/{id}/permissions | bearer | auth.api.v1.admin.users.permissions.grant |
| DELETE | auth.wbbx.de/api/v1/admin/users/{id}/permissions/{permission} | bearer | auth.api.v1.admin.users.permissions.revoke |
| POST | auth.wbbx.de/api/v1/admin/users/{id}/roles | bearer | auth.api.v1.admin.users.roles.assign |
| DELETE | auth.wbbx.de/api/v1/admin/users/{id}/roles/{role} | bearer | auth.api.v1.admin.users.roles.remove |
| GET | OPTIONS | auth.wbbx.de/api/v1/auth/preferences | — | auth.api.v1.preferences |
| GET | OPTIONS | auth.wbbx.de/api/v1/auth/session | — | auth.api.v1.session |
| GET | auth.wbbx.de/api/v1/memberships | bearer | auth.api.v1.memberships |
| POST | auth.wbbx.de/api/v1/notifications/send-email | bearer | auth.api.v1.notifications.send_email |
| GET | auth.wbbx.de/api/v1/oauth/clients | bearer | auth.api.v1.oauth.clients.index |
| POST | auth.wbbx.de/api/v1/oauth/clients | bearer | auth.api.v1.oauth.clients.store |
| GET | auth.wbbx.de/api/v1/oauth/clients/{id} | bearer | auth.api.v1.oauth.clients.show |
| PUT | PATCH | auth.wbbx.de/api/v1/oauth/clients/{id} | bearer | auth.api.v1.oauth.clients.update |
| DELETE | auth.wbbx.de/api/v1/oauth/clients/{id} | bearer | auth.api.v1.oauth.clients.destroy |
| POST | auth.wbbx.de/api/v1/oauth/clients/{id}/regenerate-secret | bearer | auth.api.v1.oauth.clients.regenerate_secret |
| GET | auth.wbbx.de/api/v1/user | bearer | auth.api.v1.user |
| GET | auth.wbbx.de/api/v1/user/addresses | bearer | auth.api.v1.user.addresses |
| POST | auth.wbbx.de/api/v1/user/addresses | bearer | auth.api.v1.user.addresses.store |
| PUT | auth.wbbx.de/api/v1/user/addresses/{id} | bearer | auth.api.v1.user.addresses.update |
| DELETE | auth.wbbx.de/api/v1/user/addresses/{id} | bearer | auth.api.v1.user.addresses.destroy |
| POST | auth.wbbx.de/api/v1/user/apps/{clientId}/email-permission | bearer | auth.api.v1.user.apps.email_permission |
| GET | auth.wbbx.de/api/v1/user/authorized-apps | bearer | auth.api.v1.user.authorized_apps |
| DELETE | auth.wbbx.de/api/v1/user/authorized-apps/{clientId} | bearer | auth.api.v1.user.authorized_apps.revoke |
| POST | auth.wbbx.de/api/v1/user/avatar | bearer | auth.api.v1.user.avatar.update |
| DELETE | auth.wbbx.de/api/v1/user/avatar | bearer | auth.api.v1.user.avatar.destroy |
| GET | auth.wbbx.de/api/v1/user/domains | bearer | auth.api.v1.user.domains |
| POST | auth.wbbx.de/api/v1/user/domains | bearer | auth.api.v1.user.domains.store |
| DELETE | auth.wbbx.de/api/v1/user/domains/{id} | bearer | auth.api.v1.user.domains.destroy |
| POST | auth.wbbx.de/api/v1/user/domains/{id}/verify | bearer | auth.api.v1.user.domains.verify |
| GET | auth.wbbx.de/api/v1/user/emails | bearer | auth.api.v1.user.emails |
| POST | auth.wbbx.de/api/v1/user/emails | bearer | auth.api.v1.user.emails.store |
| DELETE | auth.wbbx.de/api/v1/user/emails/{id} | bearer | auth.api.v1.user.emails.destroy |
| POST | auth.wbbx.de/api/v1/user/emails/{id}/verify | bearer | auth.api.v1.user.emails.verify |
| GET | auth.wbbx.de/api/v1/user/notifications | bearer | auth.api.v1.user.notifications |
| POST | auth.wbbx.de/api/v1/user/notifications/clear-read | bearer | auth.api.v1.user.notifications.clear_read |
| GET | auth.wbbx.de/api/v1/user/notifications/preferences | bearer | auth.api.v1.user.notifications.preferences |
| PUT | auth.wbbx.de/api/v1/user/notifications/preferences | bearer | auth.api.v1.user.notifications.preferences.update |
| POST | auth.wbbx.de/api/v1/user/notifications/read-all | bearer | auth.api.v1.user.notifications.read_all |
| GET | auth.wbbx.de/api/v1/user/notifications/stats | bearer | auth.api.v1.user.notifications.stats |
| DELETE | auth.wbbx.de/api/v1/user/notifications/{id} | bearer | auth.api.v1.user.notifications.destroy |
| POST | auth.wbbx.de/api/v1/user/notifications/{id}/archive | bearer | auth.api.v1.user.notifications.archive |
| POST | auth.wbbx.de/api/v1/user/notifications/{id}/pin | bearer | auth.api.v1.user.notifications.pin |
| PATCH | auth.wbbx.de/api/v1/user/notifications/{id}/read | bearer | auth.api.v1.user.notifications.mark_read |
| GET | auth.wbbx.de/api/v1/user/oauth-accounts | bearer | auth.api.v1.user.oauth_accounts |
| DELETE | auth.wbbx.de/api/v1/user/oauth-accounts/{provider} | bearer | auth.api.v1.user.oauth_accounts.destroy |
| POST | auth.wbbx.de/api/v1/user/oauth-accounts/{provider}/sync | bearer | auth.api.v1.user.oauth_accounts.sync |
| GET | auth.wbbx.de/api/v1/user/sessions | bearer | auth.api.v1.user.sessions |
| DELETE | auth.wbbx.de/api/v1/user/sessions/others | bearer | auth.api.v1.user.sessions.destroy_others |
| DELETE | auth.wbbx.de/api/v1/user/sessions/{id} | bearer | auth.api.v1.user.sessions.destroy |
| GET | auth.wbbx.de/api/v1/userinfo | bearer | auth.api.v1.userinfo |
| GET | auth.wbbx.de/avatar/default.{ext?} | — | auth.avatar.default |
| GET | auth.wbbx.de/avatar/{identifier} | — | auth.avatar.show |
| GET | POST | auth.wbbx.de/oauth/userinfo | bearer | auth.oauth.userinfo |
| GET | auth.wbbx.de/u/{identifier} | — | auth.avatar.short |
| GET | POST | auth.wbbx.de/userinfo | bearer | auth.userinfo |
| GET | auth.wbbx.de/users/{identifier}/avatar | — | auth.users.avatar |
| GET | auth.wbbx.de/{identifier}.{ext} | — | auth.avatar.file |