Internal & Non-Exposed Endpoints

Routes that exist in the codebase but are not reachable through the public gateway

This page exists so that every route in the codebase is accounted for somewhere in this documentation, even the ones you can’t call as an API consumer. It is not a reference for integrators — nothing here is reachable through https://asikodevapi.candourit.io.

/v1/internal/* — service-to-service only

user-service exposes three controllers under internal/*, marked @ApiExcludeController() so they never appear in Swagger either. api-gateway’s proxy has no route prefix for /v1/internal — there is no way to reach these from outside the private network. They exist purely so admin-service can call user-service directly (over the internal Docker network) when handling requests made to the public /v1/admin/* endpoints in the Admin reference group.

Route	Purpose
POST /v1/internal/trade-accounts/:userId/approve	Backs POST /v1/admin/trade-accounts/:userId/approve
GET /v1/internal/users	Backs GET /v1/admin/users
GET /v1/internal/users/:id	Backs GET /v1/admin/users/:id
POST /v1/internal/users/:id/roles/:role	Backs role-grant under /v1/admin/users
DELETE /v1/internal/users/:id/roles/:role	Backs role-revoke under /v1/admin/users
POST /v1/internal/users/:id/suspend	Backs POST /v1/admin/users/:id/suspend
POST /v1/internal/users/:id/reactivate	Backs POST /v1/admin/users/:id/reactivate
POST /v1/internal/users/:id/deactivate	Backs POST /v1/admin/users/:id/deactivate
GET /v1/internal/wholesale-applications	Backs GET /v1/admin/wholesale-applications
POST /v1/internal/wholesale-applications/:userId/approve	Backs the admin approval endpoint
POST /v1/internal/wholesale-applications/:userId/reject	Backs the admin rejection endpoint

If you need one of these capabilities as an API consumer, use the corresponding /v1/admin/* endpoint in the Admin reference group — it requires ADMIN/SUPER_ADMIN and forwards to the matching internal route for you.

Per-service health checks

Every backend service exposes its own GET /v1/health for container orchestration (Docker Swarm) to poll directly — api-gateway does not proxy any of these, since health checks are meant to hit each container’s own port, not go through the gateway. The only health check reachable as an API consumer is the gateway’s own:

GET https://asikodevapi.candourit.io/v1/health

which reports the gateway’s own status, not the health of the six backend services behind it.

Gateway-only dev utility

GET /v1/services/routes on api-gateway returns the internal path-prefix → service routing table used by the proxy (the same table summarized in the Introduction). It responds with 501-style {"message": "Not available in production"} whenever NODE_ENV=production, so it’s a local-development convenience, not part of the supported API.