Exhaustive table of all Discovery, Auth, profile, CRUD, invitations and modules endpoints available for a WakaApp.
Version v1.09 min read
Endpoint reference
Quick reference table. For each group: method, route, required auth, and application right. Use the Swagger UI (http://localhost/api/docs) for full DTO details.
Discovery (pre-auth — public)
Base URL: {DISCOVERY_API_URL} (default: http://localhost)
Method
Route
Throttle
Description
GET
/discover/email?email=
5/60s · 20/600s (10 min) · 100/3600s (1 h)
Find the organization by email
GET
/discover/subdomain?subdomain=
5/60s · 20/600s (10 min) · 100/3600s (1 h)
Find the organization by subdomain
GET
/discover/apps/customer?customerId=
—
Apps accessible for a customer
GET
/discover/apps/user?userId=
—
Apps accessible for a user
GET
/discover/apps/network?networkId=
—
Apps accessible for a network
POST
/discover/start-login
5/60s · 20/600s (10 min) · 100/3600s (1 h)
Resolves realm + client_id, returns keycloakUrl
Auth (wakastart BFF — public for enrich)
Base URL: {WAKASTART_BACKEND_URL} (default: http://localhost)
Method
Route
Throttle
Description
GET
/api/auth/public-key
—
Public RSA key
POST
/api/auth/enrich
— (not limited on the BFF side)
Enriches a Keycloak access_token into a wakaToken signed by WakaStart
POST
/api/auth/token/refresh
10/min (default of the BFF's ThrottlerModule)
Refreshes access_token + refresh_token + enriched
POST
/api/auth/logout
— (not limited on the BFF side)
Invalidates the refresh_token on the Keycloak side
Base URL: {PUBLIC_API_URL} (default: http://localhost)
Auth: Authorization: Bearer + x-enriched-tokenorx-api-key
Method
Route
Required right
Description
GET
/api/me
—
Full profile + roles + appRights
POST
/api/token/authorize
x-api-key
Combined check: admin level + roles + rights
POST
/api/token/rights
CustomerAdmin
Verify and enrich a JWT
POST
/api/token/check/admin-level
x-api-key
Check admin level
POST
/api/token/check/roles
x-api-key
Check Waka roles
POST
/api/token/check/hds
x-api-key
Check HDS roles
POST
/api/token/check/team
x-api-key
Check team rights
Config — Partners
Method
Route
Required right
Description
GET
/api/config/partners
partners.read
List partners
GET
/api/config/partners/:wid
partners.read
Partner detail
POST
/api/config/partners
partners.create
Create a partner
PATCH
/api/config/partners/:wid
partners.write
Update a partner
DELETE
/api/config/partners/:wid
partners.delete
Delete a partner
Config — Networks
Method
Route
Required right
Description
GET
/api/config/networks
networks.read
List networks
GET
/api/config/networks/:wid
networks.read
Network detail
POST
/api/config/networks
networks.create
Create a network
PATCH
/api/config/networks/:wid
networks.write
Update a network
Config — Customers
Method
Route
Required right
Description
GET
/api/config/customers
customers.read
List customers
GET
/api/config/customers/:wid
customers.read
Customer detail
POST
/api/config/customers
customers.create
Create a customer
PATCH
/api/config/customers/:wid
customers.write
Update a customer
DELETE
/api/config/customers/:wid
customers.delete
Delete a customer
Config — Users
Method
Route
Required right
Description
GET
/api/config/users
users.read
List users
GET
/api/config/users/:wid
users.read
User detail
GET
/api/config/users/stats
users.read
User statistics
POST
/api/config/users
users.create
Create a user
PUT
/api/config/users/:wid
users.update
Update a user
DELETE
/api/config/users/:wid
users.delete
Delete a user
POST
/api/config/users/:wid/disable
users.update
Disable a user
POST
/api/config/users/:wid/enable
users.update
Re-enable a user
Breaking change:POST /api/config/users and PUT /api/config/users/:wid used to accept a userLevel field in production until recently. The field has been removed from the DTO (CreateUserDto/UpdateUserDto) and ws-serv-config's global ValidationPipe is strict (whitelist: true, forbidNonWhitelisted: true): sending userLevel in the body of either endpoint now returns a 400 Bad Request. Remove this field from your existing integrations.
Config — Teams
Method
Route
Required right
Description
GET
/api/config/teams
teams.read
List teams
GET
/api/config/teams/:wid
teams.read
Team detail
POST
/api/config/teams
teams.create
Create a team
PATCH
/api/config/teams/:wid
teams.write
Update a team
DELETE
/api/config/teams/:wid
teams.delete
Delete a team
GET
/api/config/teams/:wid/members
teams.read
List members
POST
/api/config/teams/:wid/members
teams.members.add
Add a member
DELETE
/api/config/teams/:wid/members/:userId
teams.members.remove
Remove a member
Config — Applications
Method
Route
Required right
Description
GET
/api/config/apps
apps.read
List applications
GET
/api/config/apps/:wid
apps.read
Application detail
POST
/api/config/apps
apps.create
Create an application
PATCH
/api/config/apps/:wid
apps.write
Update an application
DELETE
/api/config/apps/:wid
apps.delete
Delete an application
GET
/api/apps/:appWid/runtime-config
—
Runtime config (theme, languages, branding)
Config — Profiles and Rights
Method
Route
Required right
Description
GET
/api/config/profiles
profiles.read
List profiles
GET
/api/config/profiles/:wid
profiles.read
Profile detail
POST
/api/config/profiles
profiles.create
Create a profile
PATCH
/api/config/profiles/:wid
profiles.write
Update a profile
DELETE
/api/config/profiles/:wid
profiles.delete
Delete a profile
GET
/api/config/profiles/:wid/rights
profiles.read
Rights of a profile
PATCH
/api/config/profiles/:wid/rights
profiles.rights.write
Update a profile's rights
GET
/api/config/profiles/:wid/users
profiles.read
Users of a profile
POST
/api/config/profiles/:wid/users
profiles.assign
Assign a profile to a user
GET
/api/config/app-rights
profiles.read
List all available AppRights
Invitations
Method
Route
Auth
Required right
Description
POST
/api/invitations
Bearer / API key
invitations.create
Create an invitation (automatic email sending)
GET
/api/invitations/sent
Bearer / API key
invitations.read
Invitations sent by the current user
GET
/api/invitations/sent/app/:appId
Bearer / API key
invitations.read
Invitations sent for an App
GET
/api/invitations/by-customer/:customerId
Bearer / API key
invitations.read
All invitations for a Customer
GET
/api/invitations/:id
Bearer / API key
invitations.read
Invitation detail
GET
/api/invitations/verify/:token
PUBLIC
—
Verify an invitation token (throttle 10/min)
POST
/api/invitations/accept/:token
PUBLIC
—
Accept an invitation (throttle 5/min)
POST
/api/invitations/:id/resend
Bearer / API key
invitations.create
Resend the email, new token
DELETE
/api/invitations/:id
Bearer / API key
invitations.revoke
Revoke an invitation
Invitation prerequisites:
invitation feature enabled in cascade (App ∧ Network ∧ Customer)
invitations.create right on the token or the API key (AppRight carried by a profile)
adminLevel >= CUSTOMER_ADMIN for the caller (human or API key)
The userLevel concept is no longer used to gate invitation creation. Sending userLevel in the body of POST /api/invitations now returns a 400 (unrecognized field).
API Keys
Method
Route
Required right
Description
GET
/api/config/api-keys
api-keys.read
List API keys
GET
/api/config/api-keys/:wid
api-keys.read
API key detail
POST
/api/config/api-keys
api-keys.create
Create an API key
DELETE
/api/config/api-keys/:wid
api-keys.revoke
Revoke an API key
Audit Logs
Method
Route
Required right
Description
GET
/api/audit/logs
audit.read
List audit logs (paginated, filterable)
GET
/api/audit/logs/:id
audit.read
Audit log detail
GET
/api/audit/stats
audit.read
Audit statistics
POST
/api/audit/export
audit.export
Export logs (CSV/JSON)
Antivirus
Method
Route
Required right
Description
POST
/api/antivirus/scans
antivirus.scan
Submit a file for scanning (multipart, max 100 MB)
GET
/api/antivirus/scans
antivirus.read
List scans (paginated)
GET
/api/antivirus/scans/stats
antivirus.read
Scan statistics
GET
/api/antivirus/scans/:id/status
antivirus.read
Poll a scan's status
GET
/api/antivirus/scans/:id
antivirus.read
Scan detail
Backup & Import
Method
Route
Required right
Description
GET
/api/backup/applications/:wid
apps.read
JSON export of an application
GET
/api/backup/networks/:wid
networks.read
JSON export of a network
GET
/api/backup/customers/:wid
customers.read
JSON export of a customer
GET
/api/backup/all
WakaAdmin
Full JSON export
POST
/api/restore/applications
apps.create
Import/upsert an application
POST
/api/restore/networks
networks.create
Import/upsert a network
POST
/api/restore/customers
customers.create
Import/upsert a customer
GET
/api/import/users/template
users.create
Download the CSV template
POST
/api/import/users
users.create
Import users from CSV (max 500, consumes credits)
Translations & Themes
Method
Route
Required right
Description
GET
/api/translations
—
List translation keys
POST
/api/ai-translation/bulk
translations.write
Bulk AI translation (credits)
POST
/api/ai-translation/single
translations.write
Single text AI translation (credits)
GET
/api/themes
themes.read
List CSS themes
POST
/api/themes
themes.create
Create a theme
MCP Server (Claude Code Integration)
Method
Route
Auth
Description
POST
/api/mcp
None (public docs)
JSON-RPC 2.0 endpoint, 5 tools available
Available MCP tools:
Tool
Description
list_endpoints
Lists all endpoints with filter by tag/method
get_endpoint_spec
Full detail (DTO, HTTP codes, examples)
search_docs
Full-text search across the guides
get_auth_flow
Summary of the auth flow (frontend/backend/mobile)
