API

Kong terminates the public prefix. Upstream paths below do not include /api.

• /v1/communication/messages — sync, async, and bulk email. Called by other services with the internal API key, not by public clients.
• /v1/communication/email/preview and /v1/communication/email/usage.
• /v1/communication/delivery-logs and delivery status.
• /v1/communication/webhooks/* provider callbacks.

The HTTP contract is OpenAPI. When a route changes, update splick-backend/openapi/openapi.yaml in the same change as the controller.

Auth

• Public user routes expect a bearer access token issued by auth-service. Kong does not validate the JWT.
• Service-to-service routes use INTERNAL_API_KEY. Do not document or commit the value.
• Rate limits for auth-sensitive routes are declared per route in splick-backend/infra/kong/kong.yml.