Skip to main content

API

Kong terminates the public prefix. Upstream paths below do not include /api.

  • ExpenseController /v1/expenses — lists, debts, analytics, netting, CRUD, settle, reminders.
  • PublicBillInviteController /v1/public/bills/{token}.
  • BillInviteController POST /v1/bills/invites/{token}/claim.
  • ExpenseInternalController /internal/v1/expenses/* for moderation, evidence, and guest email claim.

The HTTP contract is OpenAPI. When a route changes, update splick-backend/openapi/openapi.yaml in the same change as the controller.

Auth​

  • Public user routes expect a bearer access token issued by auth-service. Kong does not validate the JWT.
  • Service-to-service routes use INTERNAL_API_KEY. Do not document or commit the value.
  • Rate limits for auth-sensitive routes are declared per route in splick-backend/infra/kong/kong.yml.