Skip to main content

API

Kong terminates the public prefix. Upstream paths below do not include /api.

  • GET/POST /v1/notifications — list, mark read, mark seen, click, badge and unread counts.
  • POST/DELETE /v1/devices — device token register and revoke.
  • GET /internal/v1/notifications/badge-counts for other services.

The HTTP contract is OpenAPI. When a route changes, update splick-backend/openapi/openapi.yaml in the same change as the controller.

Auth​

  • Public user routes expect a bearer access token issued by auth-service. Kong does not validate the JWT.
  • Service-to-service routes use INTERNAL_API_KEY. Do not document or commit the value.
  • Rate limits for auth-sensitive routes are declared per route in splick-backend/infra/kong/kong.yml.