Skip to main content

API

Kong terminates the public prefix. Upstream paths below do not include /api.

  • POST /v1/media/uploads and POST /v1/media/uploads/{uploadId}/complete.
  • DELETE /v1/media/{id}.
  • Filter catalog GET /v1/media/filters.
  • Admin reconciliation under /v1/media/admin/reconciliation/*.
  • Music search, trending, saved tracks, resolve, and Apple developer token under /v1/music.
  • Internal GET /internal/v1/media/{mediaId} and POST /internal/v1/media/ingest.

The HTTP contract is OpenAPI. When a route changes, update splick-backend/openapi/openapi.yaml in the same change as the controller.

Auth​

  • Public user routes expect a bearer access token issued by auth-service. Kong does not validate the JWT.
  • Service-to-service routes use INTERNAL_API_KEY. Do not document or commit the value.
  • Rate limits for auth-sensitive routes are declared per route in splick-backend/infra/kong/kong.yml.