/api/auth/* | Publish | Core auth/session contracts for all clients. |
/api/mobile/start, /callback, /verify, /exchange | Publish | Native OAuth + one-time MobileSession ticket exchange. |
/api/user/* (non-dev endpoints) | Publish | Core user/profile/follow/support contracts. |
/api/user/check-username | Publish | Public handle availability check. |
/api/user/mutes, /api/user/blocks | Publish | Authenticated one-way mute and stronger block; handle or User.id refs. |
/api/user/featured-collectibles | Publish | Public profile showcase + authenticated replace (max 12). |
/api/locker-room* | Publish | Includes per-post GET/PUT/DELETE. |
/api/leaderboard* (non-reset internal paths) | Publish | Core ranking/season behavior for clients. |
/api/quests* | Publish | Core quest progression contracts and side effects. |
/api/v1/engage/quests/* | Publish | Daily quiz sessions, forfeit, arena check-in, daily summary. Canonical /api prefix. |
/api/v1/engage/rep/* | Publish | Fan Rep breakdown, ledger, me/player-me, and client-safe earn. Direct kinds on /earn return 403. |
/api/admin/users/{userId}/rep | Publish with redaction | D-Sports Direct grant (isAdmin). Document amount/reason contract only. |
/api/rewards, /api/rewards/claim, /api/rewards/redeem | Publish | Public reward flow contracts. |
/api/teams, /api/teams/followed, /api/teams/{id}, /api/teams/{id}/follow, /api/leagues | Publish | Team/league integrations for all clients. GET /api/teams/{id} resolves id, then slug. |
/api/config/sports | Publish | Public sports + leagues catalog derived from League.sport. |
/api/teams/search, /api/teams?slug= | Publish | Search (q/sport/league/cursor/limit/sort) and single-team slug lookup. |
/api/me/starred-teams, /api/me/starred-teams/{teamId} | Publish | HQ bookmarks. Not follows. 50-club cap. |
/api/teams/{id}/join, /api/user/teams | Publish | Leaderboard join/leave vs social follow. Returns { joinedTeamIds, followedTeamIds }. |
/api/teams/{id}/roster | Publish | Public real-player roster for the lineup builder. |
/api/user/settings | Publish | Authenticated settings SoT, including per-channel notify flags. |
/api/locker-room/posts/draft, /{id}/like, /{id}/poll/vote | Publish | Composer draft, additive likes, and poll votes. |
/api/events/* | Publish | Game Center schedule, realtime discovery, detail, stats, player-stats, plays, lineup, top-performer, win-probability, chat, mute, presence, ratings, live-activity. |
/api/discovery/teams, /api/discovery/fans | Publish | Suggested teams (public) and fans (authenticated). |
/api/products, /api/packs*, /api/checkout*, /api/dsports-cash | Publish | Commerce and pack-opening core contracts. PUT /api/packs/{id}/purchase is deprecated and returns 410. |
/api/wallets*, /api/crypto-prices | Publish | Wallet and pricing client contracts in OpenAPI. |
/api/wallets/{address}/sign-transaction, /export | Publish | Custodial server-side sign/export. private-key is deprecated. |
/api/feedback/* | Publish | User-facing reporting channels. |
/api/accessibility | Publish | Public Apple Nutrition Label support matrix for native and marketing. |
/api/notifications* (non-admin) | Publish | Authenticated inbox, read, read-all, archive. Includes GAME_ALERT and RATING. |
/api/games/catalog | Publish | Public per-team mini-game catalog consumed by native clients. |
/api/games/daily-spin/config, /state, /spin | Publish | Public config + authenticated spin/state. |
/api/games/guess-player/session/start, /guess | Publish | Authenticated Guess the Player session. |
/api/games/live/active | Publish | Public-ish live-now summary for a team. |
/api/leagues/{leagueId}/standings | Publish | Public HQ standings (rows, tiebreakRules, tables). |
/api/teams/{id}/head-to-head | Publish | Public HQ series vs an opponent. |
/api/feed/signals | Publish | Authenticated behavioral ingest. Dropped when analyticsPersonalization is false. Opted-in batches persist as FeedSignal rows (max 50 events, 64KB, 30 batches/min). The response includes accepted. |
/api/admin/players/{playerId}/availability | Publish with redaction | Platform admin injury/availability. Null status clears to available. |
/api/v1/engage/games/* | Publish | Game Engine catalog, session verbs, and the locker-singularity idle ledger. See Game Engine API. |
/api/games/guess-player/players, /session/invalidate | Publish | Authenticated Guess the Player autocomplete and session invalidate. |
/api/games/live/by-code/{code}, /join, /{sessionId}/leaderboard, /{sessionId}/score | Publish | Authenticated live-arena fan routes. |
/api/games/live/start, /api/games/live/{sessionId}/end | Publish with redaction | Team-manager start/end. Document RBAC only. |
/api/games/pick-em/players | Publish | Leftover roster helper. Engine Pick’em does not use this path. |
/api/games/daily-spin/reward | Publish | Deprecated compat adapter in OpenAPI. New clients use POST /api/games/daily-spin/spin. |
/api/binders* | Publish | Digital binder CRUD, card assign/order, transfer, and PIN. Live PIN gate uses x-binder-pin-token; OpenAPI descriptions still say { granted } only. |
/api/v1/cards/{id}/provenance | Publish | Public ownership / sale / mint history. |
/api/v1/marketplace/* | Publish | Expanded catch-all. Native listings/mine aliases me/listings. Create requires x-listing-pin-token. Pack listing can return 409 PACK_NOT_LISTABLE or PACK_ALREADY_OPENED. See Commerce. |
/api/v1/kyc/link-token, /api/v1/kyc/session/complete, /api/v1/user/kyc-status | Publish | Authenticated KYC session helpers. Status only; no vendor secrets. |
/api/admin/games*, /api/admin/teams/[teamId]/games | Publish with redaction | Catalogue management and team game selection; redact ops internals. |
/api/admin/teams* | Publish with redaction | Contributor-needed team management behavior; redact sensitive ops internals. |
/api/admin/team-assignments | Publish with redaction | RBAC and assignment flow are needed for contributors. |
/api/admin/stats | Publish with redaction | High-level contract only, no privileged internals. |
/api/admin/notifications/announce | Publish with redaction | Behavior-level contract and RBAC only. |
/api/admin/leagues/sync, /api/admin/teams/sync | Publish with redaction | Trigger semantics useful for contributors; keep internals abstracted. |
/api/webhooks/leagues-sync | Publish with redaction | Integration architecture needs webhook reference; redact secret values. |
/api/debug*, /api/*debug*, /api/groq-test, /api/test-sentry, /api/sentry-example-api | Exclude | Debug/dev/testing routes are not public doc surface. |
/api/cron/* | Exclude | Internal ops/automation endpoints. |
/api/internal/* | Exclude | Service-to-service internals. |
/api/admin/fix-team-ownership | Exclude | Internal remediation path not for public docs. |
/api/rewards/admin-override | Exclude | Privileged override operation. |
/api/leaderboard/reset | Exclude | Internal/privileged maintenance behavior. |
/api/team-access/* | Exclude | Frozen separately in openapi/team-access.v1.json. Not part of the public Engage spec. |
/api/events/alerts/season-start | Exclude | Not in the public spec. Native season reminders opt in through OneSignal. |
/api/user/all | Shipped, OpenAPI pending | Native community directory. Stays out of this spec until d-sports-api#738 merges. |
/api/invites/*, /api/user/support/*, /api/user/follow-requests*, /api/upload/*, /api/packs/{id}/odds | Publish | Invites, support tickets, follow requests, uploads, and public pack odds. |
/api/v1/user/set-pin, /api/v1/user/verify-pin, /api/v1/users/contacts/match | Publish | Marketplace listing PIN and hashed contact match. |
/api/wallets/link-external, /link-challenge, /reset-pin, /{address}/attestation | Publish | Wallet link/reset helpers. Attestation path value is the wallet database id. |
/api/health, /api/mobile/version, /api/mobile/wallet-callback | Publish | Liveness and mobile helpers. |
/api/news*, /api/pins, /api/prompts, /api/commerce | Publish | Public CMS/commerce reads. |
/api/v1/engage/player-challenge/complete | Publish | Retired. Returns 410. |
