# API route inventory

Generated from this checkout on 5 October 2026 (Africa/Johannesburg).

`[id]`, `[poNumber]`, etc. are path parameters. `[...filename]` is a catch-all. The proxy category below is from `src/lib/auth/proxy-path.ts` for `AUTH_MODE=users`; route handlers can require additional credentials, site permissions, or an Origin header. PIN mode skips the proxy login check. A `machine` category means the proxy defers authentication to the handler, usually `x-ingest-secret`.

See [the connection guide](./api-and-mcp-connections.md) for authentication and tested examples. This inventory replaces assumptions based on older route documentation.

| Methods | Route | Proxy category | Source |
| --- | --- | --- | --- |
| PATCH, DELETE | `/api/admin/users/[id]` | admin | [route.ts](../../src/app/api/admin/users/[id]/route.ts) |
| GET, POST | `/api/admin/users` | manager | [route.ts](../../src/app/api/admin/users/route.ts) |
| POST | `/api/agent/actions/[id]/apply` | admin | [route.ts](../../src/app/api/agent/actions/[id]/apply/route.ts) |
| POST | `/api/agent/actions/[id]/reject` | admin | [route.ts](../../src/app/api/agent/actions/[id]/reject/route.ts) |
| GET | `/api/agent/actions/[id]` | admin | [route.ts](../../src/app/api/agent/actions/[id]/route.ts) |
| POST | `/api/agent/actions/[id]/undo` | admin | [route.ts](../../src/app/api/agent/actions/[id]/undo/route.ts) |
| PATCH | `/api/ask/change-requests/[id]` | admin | [route.ts](../../src/app/api/ask/change-requests/[id]/route.ts) |
| GET | `/api/ask/change-requests` | admin | [route.ts](../../src/app/api/ask/change-requests/route.ts) |
| DELETE | `/api/ask/memories/[id]` | admin | [route.ts](../../src/app/api/ask/memories/[id]/route.ts) |
| GET, POST | `/api/ask/memories` | admin | [route.ts](../../src/app/api/ask/memories/route.ts) |
| GET | `/api/ask/messages/[id]/pdf` | admin | [route.ts](../../src/app/api/ask/messages/[id]/pdf/route.ts) |
| GET | `/api/ask/users` | admin | [route.ts](../../src/app/api/ask/users/route.ts) |
| POST | `/api/auth/change-password` | public | [route.ts](../../src/app/api/auth/change-password/route.ts) |
| POST | `/api/auth/login` | public | [route.ts](../../src/app/api/auth/login/route.ts) |
| POST | `/api/auth/logout` | public | [route.ts](../../src/app/api/auth/logout/route.ts) |
| POST | `/api/chat/attachments` | admin | [route.ts](../../src/app/api/chat/attachments/route.ts) |
| POST | `/api/chat` | admin | [route.ts](../../src/app/api/chat/route.ts) |
| GET, PATCH, DELETE | `/api/chat/threads/[id]` | admin | [route.ts](../../src/app/api/chat/threads/[id]/route.ts) |
| GET, POST | `/api/chat/threads` | admin | [route.ts](../../src/app/api/chat/threads/route.ts) |
| GET | `/api/clock/employee-lookup` | clock | [route.ts](../../src/app/api/clock/employee-lookup/route.ts) |
| GET | `/api/clock/employee-search` | clock | [route.ts](../../src/app/api/clock/employee-search/route.ts) |
| POST | `/api/clock/events/[id]/correct` | clock | [route.ts](../../src/app/api/clock/events/[id]/correct/route.ts) |
| POST | `/api/clock/scan` | clock | [route.ts](../../src/app/api/clock/scan/route.ts) |
| POST | `/api/clock/vehicle-lookup` | clock | [route.ts](../../src/app/api/clock/vehicle-lookup/route.ts) |
| POST | `/api/clock/vehicle-scan` | clock | [route.ts](../../src/app/api/clock/vehicle-scan/route.ts) |
| GET | `/api/dashboard-attention` | dashboard | [route.ts](../../src/app/api/dashboard-attention/route.ts) |
| POST | `/api/data-import-batches/[id]/retry` | clock | [route.ts](../../src/app/api/data-import-batches/[id]/retry/route.ts) |
| GET | `/api/data-import-batches/[id]/status` | clock | [route.ts](../../src/app/api/data-import-batches/[id]/status/route.ts) |
| POST | `/api/delivery-notes/[id]/assign-po` | clock | [route.ts](../../src/app/api/delivery-notes/[id]/assign-po/route.ts) |
| POST | `/api/delivery-notes/[id]/ocr-result` | admin | [route.ts](../../src/app/api/delivery-notes/[id]/ocr-result/route.ts) |
| GET | `/api/delivery-notes/[id]/slip` | machine | [route.ts](../../src/app/api/delivery-notes/[id]/slip/route.ts) |
| POST | `/api/delivery-notes/upload` | clock | [route.ts](../../src/app/api/delivery-notes/upload/route.ts) |
| POST | `/api/dn-batches/[id]/assembly` | clock | [route.ts](../../src/app/api/dn-batches/[id]/assembly/route.ts) |
| POST | `/api/dn-batches/[id]/dismiss` | clock | [route.ts](../../src/app/api/dn-batches/[id]/dismiss/route.ts) |
| POST | `/api/dn-batches/[id]/notes/[noteId]/correct-receipt` | clock | [route.ts](../../src/app/api/dn-batches/[id]/notes/[noteId]/correct-receipt/route.ts) |
| POST | `/api/dn-batches/[id]/notes/[noteId]/dismiss` | clock | [route.ts](../../src/app/api/dn-batches/[id]/notes/[noteId]/dismiss/route.ts) |
| POST | `/api/dn-batches/[id]/notes/[noteId]/matching` | clock | [route.ts](../../src/app/api/dn-batches/[id]/notes/[noteId]/matching/route.ts) |
| POST | `/api/dn-batches/[id]/notes/[noteId]/post-line` | clock | [route.ts](../../src/app/api/dn-batches/[id]/notes/[noteId]/post-line/route.ts) |
| POST | `/api/dn-batches/[id]/notes/[noteId]/post` | clock | [route.ts](../../src/app/api/dn-batches/[id]/notes/[noteId]/post/route.ts) |
| GET, POST | `/api/dn-batches/[id]/notes/[noteId]/processing-preview` | clock | [route.ts](../../src/app/api/dn-batches/[id]/notes/[noteId]/processing-preview/route.ts) |
| POST | `/api/dn-batches/[id]/notes/[noteId]/resolve-entities` | clock | [route.ts](../../src/app/api/dn-batches/[id]/notes/[noteId]/resolve-entities/route.ts) |
| POST | `/api/dn-batches/[id]/notes/[noteId]/resolve-item` | clock | [route.ts](../../src/app/api/dn-batches/[id]/notes/[noteId]/resolve-item/route.ts) |
| PATCH | `/api/dn-batches/[id]/notes/[noteId]` | clock | [route.ts](../../src/app/api/dn-batches/[id]/notes/[noteId]/route.ts) |
| POST | `/api/dn-batches/[id]/pages/[n]/dismiss` | clock | [route.ts](../../src/app/api/dn-batches/[id]/pages/[n]/dismiss/route.ts) |
| GET | `/api/dn-batches/[id]/pages/[n]` | clock | [route.ts](../../src/app/api/dn-batches/[id]/pages/[n]/route.ts) |
| POST | `/api/dn-batches/[id]/rerun` | clock | [route.ts](../../src/app/api/dn-batches/[id]/rerun/route.ts) |
| POST | `/api/dn-batches/tick` | machine | [route.ts](../../src/app/api/dn-batches/tick/route.ts) |
| POST | `/api/fuel-logs/import` | clock | [route.ts](../../src/app/api/fuel-logs/import/route.ts) |
| GET | `/api/health` | public | [route.ts](../../src/app/api/health/route.ts) |
| GET | `/api/pb-files/[collection]/[recordId]/[...filename]` | clock | [route.ts](../../src/app/api/pb-files/[collection]/[recordId]/[...filename]/route.ts) |
| DELETE | `/api/plant-hours/[id]` | clock | [route.ts](../../src/app/api/plant-hours/[id]/route.ts) |
| GET | `/api/plant-hours/exception-report/[sheetId]` | clock | [route.ts](../../src/app/api/plant-hours/exception-report/[sheetId]/route.ts) |
| POST | `/api/plant-hours/import` | clock | [route.ts](../../src/app/api/plant-hours/import/route.ts) |
| GET | `/api/plant-hours/template` | clock | [route.ts](../../src/app/api/plant-hours/template/route.ts) |
| GET | `/api/purchase-orders/[id]/delivery-reconciliation` | machine | [route.ts](../../src/app/api/purchase-orders/[id]/delivery-reconciliation/route.ts) |
| GET | `/api/purchase-orders/[id]/document` | clock | [route.ts](../../src/app/api/purchase-orders/[id]/document/route.ts) |
| PATCH, DELETE | `/api/purchase-orders/[id]/items/[itemId]` | clock | [route.ts](../../src/app/api/purchase-orders/[id]/items/[itemId]/route.ts) |
| POST | `/api/purchase-orders/[id]/items` | clock | [route.ts](../../src/app/api/purchase-orders/[id]/items/route.ts) |
| GET | `/api/purchase-orders/[id]/pages/[n]` | clock | [route.ts](../../src/app/api/purchase-orders/[id]/pages/[n]/route.ts) |
| POST | `/api/purchase-orders/[id]/retry` | clock | [route.ts](../../src/app/api/purchase-orders/[id]/retry/route.ts) |
| GET | `/api/purchase-orders/[id]/status` | clock | [route.ts](../../src/app/api/purchase-orders/[id]/status/route.ts) |
| POST | `/api/purchase-orders/[id]/supplier` | clock | [route.ts](../../src/app/api/purchase-orders/[id]/supplier/route.ts) |
| GET | `/api/purchase-orders/by-number/[poNumber]/items` | machine | [route.ts](../../src/app/api/purchase-orders/by-number/[poNumber]/items/route.ts) |
| POST | `/api/purchase-orders/ingest` | machine | [route.ts](../../src/app/api/purchase-orders/ingest/route.ts) |
| POST | `/api/purchase-orders/process-batch` | machine | [route.ts](../../src/app/api/purchase-orders/process-batch/route.ts) |
| POST | `/api/purchase-orders/upload` | clock | [route.ts](../../src/app/api/purchase-orders/upload/route.ts) |
| POST | `/api/records/[collection]/[id]/verify` | admin | [route.ts](../../src/app/api/records/[collection]/[id]/verify/route.ts) |
| POST | `/api/sites/[id]/fixed-costs` | clock | [route.ts](../../src/app/api/sites/[id]/fixed-costs/route.ts) |
| PATCH | `/api/sites/[id]` | clock | [route.ts](../../src/app/api/sites/[id]/route.ts) |
| POST | `/api/sites` | clock | [route.ts](../../src/app/api/sites/route.ts) |
| PATCH | `/api/suppliers/[id]` | clock | [route.ts](../../src/app/api/suppliers/[id]/route.ts) |
| POST | `/api/suppliers` | clock | [route.ts](../../src/app/api/suppliers/route.ts) |
| POST | `/api/timesheets/import` | clock | [route.ts](../../src/app/api/timesheets/import/route.ts) |
| POST, DELETE | `/api/vehicles/[id]/attention-dismiss` | clock | [route.ts](../../src/app/api/vehicles/[id]/attention-dismiss/route.ts) |
| POST | `/api/vehicles/[id]/merge` | clock | [route.ts](../../src/app/api/vehicles/[id]/merge/route.ts) |
| PATCH, DELETE | `/api/vehicles/[id]` | clock | [route.ts](../../src/app/api/vehicles/[id]/route.ts) |
| POST | `/api/vehicles/import-summary` | clock | [route.ts](../../src/app/api/vehicles/import-summary/route.ts) |
| POST | `/api/vehicles` | clock | [route.ts](../../src/app/api/vehicles/route.ts) |

78 route files. Next.js may also supply HEAD/OPTIONS automatically; the table lists explicitly exported methods.