6  Overview

What the platform exposes, counted from the specification.

6.1 By service

Service	Operations
Web backend	168
AI gateway	28
Total	196

6.2 By method

Method	Operations
GET	97
POST	78
PATCH	12
DELETE	8
PUT	1

99 of 196 operations change state.

6.3 By declared authentication

Scheme	Operations
CookieAuth, SupabaseAuth	80
SupabaseAuth	26
SupabaseAuth, CookieAuth	23
bearerAuth	22
CookieAuth	20
none	19
not declared	6

not declared means the specification says nothing, which is not the same as public. 25 operations use a service-role client that bypasses row-level security; 1 of those additionally contains no call that verifies a caller, and is listed in the security appendix.

6.4 Stated intent

160 of 196 operations record why they exist, in an @intent docblock on the handler carried into the specification. Everything else in this document is derived from the code or the specification and complete by construction; intent is the exception, because reading a handler reveals what an operation does and never what it was for.

61 of those 160 are marked †, meaning the sentence was written by someone reading the handler rather than by whoever decided the operation should exist. The distinction is worth keeping: an inference can be accurate about behaviour and confidently wrong about purpose, and only the author can settle which. Treat a † as a starting point for review rather than as a record of a decision.

The remaining 36 record no intent at all.

6.5 Data models

97 shapes are declared in the specification and documented in the Data models appendix.