Route Map

Every method, URL, target action, and required permission.

Route Map

"Auth" means any authenticated user; a permission slug means the firewall also requires prc.authUser.hasPermission() to pass (see Security & Permissions) — failing that redirects to dashboard.notAuthorized instead of login.

Every POST, PUT, and DELETE route below requires a valid CSRF token in rc.csrf. GET routes do not — see CSRF verification.

The :userId, :roleId, :permissionId, :auditLogId, :settingId, :tokenId, :passkeyId, and :size placeholders are the literal parameter names the router binds into rc. :size is sm or lg.

MethodURLHandler.ActionAuth
GET/loginAuth.loginGuest
POST/loginAuth.doLoginGuest
GET/registerAuth.registerGuest
POST/registerAuth.doRegisterGuest
GET/register/check-emailAuth.checkEmailAvailabilityGuest
GET/verify-registrationAuth.verifyRegistrationGuest
GET/activate-invitationAuth.activateInvitationGuest
POST/activate-invitationAuth.doActivateInvitationGuest
GET/confirm-email-changeAuth.verifyEmailChangeGuest or Auth — reachable either way, unlike the other Auth actions (see Handlers & Routing)
GET/forgot-passwordAuth.forgotPasswordGuest
POST/forgot-passwordAuth.doForgotPasswordGuest
GET/reset-passwordAuth.resetPasswordGuest
POST/reset-passwordAuth.doResetPasswordGuest
POST/logoutAuth.logoutAuth
GET/dashboardDashboard.indexAuth
GET/auditlogAuditLog.indexauditlog:read,auditlog:admin
GET/auditlog/:auditLogIdAuditLog.showauditlog:read,auditlog:admin
GET/auditlog/searchAuditLog.searchauditlog:read,auditlog:admin
GET/auditlog/exportAuditLog.exportauditlog:export,auditlog:admin
POST/auditlog/purgeAuditLog.purgeauditlog:delete,auditlog:admin
DELETE/auditlog/clearAuditLog.clearauditlog:admin
GET/usersUsers.indexusers:read,users:admin
GET/users/searchUsers.searchusers:read,users:admin
POST/usersUsers.createusers:write,users:admin
GET/users/:userIdUsers.showusers:read
PUT/users/:userIdUsers.updateusers:write,users:admin
DELETE/users/:userIdUsers.deleteusers:delete,users:admin
POST/users/:userId/invitationUsers.resendInvitationusers:write,users:admin
PUT/users/:userId/profileUsers.updateProfileusers:write,users:admin
POST/users/:userId/statusUsers.setStatususers:write,users:admin
POST/users/:userId/preferencesUsers.savePreferencesusers:write,users:admin
POST/users/:userId/reset-passwordUsers.resetPasswordusers:admin
POST/users/:userId/force-password-resetUsers.forcePasswordResetusers:admin
POST/users/:userId/verifyUsers.verifyusers:admin
POST/users/:userId/revoke-remember-tokensUsers.revokeRememberTokensusers:admin
POST/users/:userId/roles/:roleIdUsers.addRoleusers:admin
DELETE/users/:userId/roles/:roleIdUsers.removeRoleusers:admin
POST/users/:userId/permissions/:permissionIdUsers.addPermissionusers:admin
DELETE/users/:userId/permissions/:permissionIdUsers.removePermissionusers:admin
POST/users/:userId/tokens/revoke-allUsers.revokeAllTokensusers:admin
DELETE/users/:userId/tokens/:tokenIdUsers.revokeTokenusers:admin
GET/rolesRoles.indexroles:read,roles:admin
POST/rolesRoles.createroles:write,roles:admin
PUT/roles/:roleIdRoles.updateroles:write,roles:admin
DELETE/roles/:roleIdRoles.deleteroles:delete,roles:admin
GET/roles/:roleId/usersRoles.usersroles:read,roles:admin
GET/roles/:roleId/available-usersRoles.availableUsersroles:read,roles:admin
POST/roles/:roleId/users/:userIdRoles.addUserroles:admin
DELETE/roles/:roleId/users/:userIdRoles.removeUserroles:admin
GET/permissionsPermissions.indexpermissions:read,permissions:admin
POST/permissionsPermissions.createpermissions:write,permissions:admin
PUT/permissions/:permissionIdPermissions.updatepermissions:write,permissions:admin
DELETE/permissions/:permissionIdPermissions.deletepermissions:delete,permissions:admin
GET/profileProfile.indexAuth
POST/profileProfile.saveAuth
GET/profile/passkey-requiredProfile.passkeyRequiredAuth
POST/profile/passwordProfile.doPasswordChangeAuth
POST/profile/email-changeProfile.requestEmailChangeAuth
DELETE/profile/email-changeProfile.cancelEmailChangeAuth
GET/profile/api-tokensProfile.listTokensAuth
POST/profile/api-tokensProfile.createTokenAuth
POST/profile/api-tokens/:tokenIdProfile.updateTokenAuth
DELETE/profile/api-tokens/:tokenIdProfile.deleteTokenAuth
GET/profile/passkeysProfile.listPasskeysAuth
POST/profile/passkeysProfile.updatePasskeyAuth
DELETE/profile/passkeys/:passkeyIdProfile.deletePasskeyAuth
POST/profile/avatarProfile.uploadAvatarAuth
DELETE/profile/avatarProfile.deleteAvatarAuth
GET/settingsSettings.indexsettings:read,settings:admin
POST/settingsSettings.savesettings:write,settings:admin
GET/settings/registrySettings.registrysettings:read,settings:admin
POST/settings/registrySettings.createRegistrysettings:write,settings:admin
GET/settings/registry/searchSettings.registrySearchsettings:read,settings:admin
PUT/settings/registry/:settingIdSettings.updateRegistrysettings:write,settings:admin
DELETE/settings/registry/:settingIdSettings.deleteRegistrysettings:write,settings:admin
POST/settings/registry/:settingId/statusSettings.toggleRegistryStatussettings:write,settings:admin
POST/settings/clear-template-cacheSettings.clearTemplateCachesettings:admin
POST/settings/clear-sessions-cacheSettings.clearSessionsCachesettings:admin
POST/settings/revoke-remember-tokensSettings.revokeRememberTokenssettings:admin
POST/settings/flush-settings-cacheSettings.flushSettingsCachesettings:admin
POST/settings/logoSettings.uploadLogosettings:write,settings:admin
DELETE/settings/logoSettings.deleteLogosettings:write,settings:admin
GET/avatars/:userId/:sizeAssets.avatarAuth
GET/branding/logo/:sizeAssets.logoPublic
GET/healthcheckReturns Ok!Public

All routes also support the conventions-based catch-all pattern /:handler/:action?, matched last in app/config/Router.bx.

Handlers & RoutingEvery handler, its actions, and how Router.bx wires URLs to them. Security & PermissionsSession auth, CSRF, JWT, security headers, and the resource:action permission model.
Edit this page Download Markdown Last updated Sep 16, 2026, 5:50:56 PM