# Public API exclusions

Documentation does not change route availability or permissions. HEAD uses its GET contract. These routes are intentionally not offered in the interactive portal.

| Method | Path | Reason |
|---|---|---|
| GET | `/sanctum/csrf-cookie` | Framework, static-file, health or retired route; not an application data API. |
| GET | `/api-keys` | Framework, static-file, health or retired route; not an application data API. |
| POST | `/api-keys` | Framework, static-file, health or retired route; not an application data API. |
| DELETE | `/api-keys/{key}` | Framework, static-file, health or retired route; not an application data API. |
| GET | `/customer-sharing/settings` | Framework, static-file, health or retired route; not an application data API. |
| PUT | `/customer-sharing/settings` | Framework, static-file, health or retired route; not an application data API. |
| POST | `/customer-sharing/refresh` | Framework, static-file, health or retired route; not an application data API. |
| GET | `/customer-sharing/records/{record}` | Framework, static-file, health or retired route; not an application data API. |
| PUT | `/customer-sharing/records/{record}` | Framework, static-file, health or retired route; not an application data API. |
| GET | `/test` | Framework, static-file, health or retired route; not an application data API. |
| GET | `/meta/webhook/{webhook}` | Provider ingress/callback; not a client-callable application API. |
| POST | `/meta/webhook/{webhook}` | Provider ingress/callback; not a client-callable application API. |
| POST | `/register` | Framework, static-file, health or retired route; not an application data API. |
| POST | `/login` | Framework, static-file, health or retired route; not an application data API. |
| POST | `/api/auth/workspace` | Interactive identity/session lifecycle; use the supported sign-in and API-key setup UI. |
| POST | `/logout` | Interactive identity/session lifecycle; use the supported sign-in and API-key setup UI. |
| POST | `/auth/logout` | Interactive identity/session lifecycle; use the supported sign-in and API-key setup UI. |
| POST | `/auth/logout-all` | Interactive identity/session lifecycle; use the supported sign-in and API-key setup UI. |
| POST | `/workspaces` | Retired local organisation/team mutation; centrally managed through Auto Appy. |
| PUT | `/workspaces/{workspace}` | Retired local organisation/team mutation; centrally managed through Auto Appy. |
| PATCH | `/workspaces/{workspace}` | Retired local organisation/team mutation; centrally managed through Auto Appy. |
| DELETE | `/workspaces/{workspace}` | Retired local organisation/team mutation; centrally managed through Auto Appy. |
| POST | `/workspaces/{workspace}/organisation-connection` | Trust binding or stored service credentials; configure through the authenticated application. |
| POST | `/workspaces/{workspace}/users` | Retired local organisation/team mutation; centrally managed through Auto Appy. |
| PUT | `/workspaces/{workspace}/users/{workspaceUser}` | Retired local organisation/team mutation; centrally managed through Auto Appy. |
| DELETE | `/workspaces/{workspace}/users/{workspaceUser}` | Retired local organisation/team mutation; centrally managed through Auto Appy. |
| GET | `/workspaces/{workspace}/whatsapp-accounts/{whatsappAccount}/phone-numbers/{phoneNumber}/webhook-logs` | Internal service protocol, operational logs or provider delivery acknowledgement. |
| POST | `/workspaces/{workspace}/whatsapp-accounts/{whatsappAccount}/phone-numbers/{phoneNumber}/webhook-logs` | Internal service protocol, operational logs or provider delivery acknowledgement. |
| GET | `/workspaces/{workspace}/whatsapp-accounts/{whatsappAccount}/phone-numbers/{phoneNumber}/webhook-logs/{webhookLog}` | Internal service protocol, operational logs or provider delivery acknowledgement. |
| PUT | `/workspaces/{workspace}/whatsapp-accounts/{whatsappAccount}/phone-numbers/{phoneNumber}/webhook-logs/{webhookLog}` | Internal service protocol, operational logs or provider delivery acknowledgement. |
| PATCH | `/workspaces/{workspace}/whatsapp-accounts/{whatsappAccount}/phone-numbers/{phoneNumber}/webhook-logs/{webhookLog}` | Internal service protocol, operational logs or provider delivery acknowledgement. |
| DELETE | `/workspaces/{workspace}/whatsapp-accounts/{whatsappAccount}/phone-numbers/{phoneNumber}/webhook-logs/{webhookLog}` | Internal service protocol, operational logs or provider delivery acknowledgement. |
| GET | `/phone-numbers/{phoneNumber}/webhook` | Provider ingress/callback; not a client-callable application API. |
| POST | `/phone-numbers/{phoneNumber}/webhook` | Provider ingress/callback; not a client-callable application API. |
| PUT | `/phone-numbers/{phoneNumber}/webhook/regenerate` | Provider ingress/callback; not a client-callable application API. |
| DELETE | `/phone-numbers/{phoneNumber}/webhook` | Provider ingress/callback; not a client-callable application API. |
| GET | `/whatsapp-conversations/{conversation}/runtime/history/raw` | Internal service protocol, operational logs or provider delivery acknowledgement. |
| PUT | `/workspaces/{workspace}/ai-connection` | Trust binding or stored service credentials; configure through the authenticated application. |
| GET | `/up` | Framework, static-file, health or retired route; not an application data API. |
| GET | `//` | Framework, static-file, health or retired route; not an application data API. |
| GET | `/auth/autoappy/redirect` | Interactive identity/session lifecycle; use the supported sign-in and API-key setup UI. |
| GET | `/auth/autoappy/callback` | Interactive identity/session lifecycle; use the supported sign-in and API-key setup UI. |
| GET | `/broadcasting/auth` | Framework, static-file, health or retired route; not an application data API. |
| POST | `/broadcasting/auth` | Framework, static-file, health or retired route; not an application data API. |
| GET | `/storage/{path}` | Framework, static-file, health or retired route; not an application data API. |
| PUT | `/storage/{path}` | Framework, static-file, health or retired route; not an application data API. |

0 third-party adapter operations are internal-only and omitted from this portal and its downloads. Exact paths are recorded only in the repository developer audit.