# Canonical Airlock IAM REST route catalogue # Date: 2026-11-10 This is the de-duplicated current server-handler inventory for the four German Airlock IAM tenants. It consolidates the complete production JavaScript graph, source-recovered methods, CSRF-correct method discovery and four-tenant parity evidence. - active route templates: 380 - active method/path bindings: 390 - excluded non-handler source prefixes or bare resolver names: 8 - Angular client routes are separate: 214 templates in `recon/airlock-angular-ui-route-graph-v1.txt` One hundred seventy-four server-only/legacy templates are supplied by `recon/airlock-server-only-route-expansion-v1.txt`. The previous append-only source inventory remains `recon/airlock-registration-source-routes-v8.txt`; this catalogue is authoritative for active REST handlers because it removes source composition prefixes and bare UI resolver names that return 404. ## Active handlers method template access GET /auth/rest/oauth2/application.wadl oauth2 GET /auth/rest/oauth2/application.wadl/{param} oauth2 GET /auth/rest/oauth2/authorization-servers/{param}/.well-known/oauth-authorization-server oauth2 GET /auth/rest/oauth2/authorization-servers/{param}/.well-known/openid-configuration oauth2 POST /auth/rest/oauth2/authorization-servers/{param}/check-origin session-public POST /auth/rest/oauth2/authorization-servers/{param}/introspect oauth2 GET /auth/rest/oauth2/authorization-servers/{param}/jwks oauth2 POST /auth/rest/oauth2/authorization-servers/{param}/par oauth2 GET /auth/rest/oauth2/authorization-servers/{param}/resources/{param} oauth2 POST /auth/rest/oauth2/authorization-servers/{param}/resources/{param} oauth2 POST /auth/rest/oauth2/authorization-servers/{param}/revoke oauth2 GET /auth/rest/oauth2/authorization-servers/{param}/session oauth2 PATCH /auth/rest/oauth2/authorization-servers/{param}/session/custom-attributes oauth2 DELETE /auth/rest/oauth2/authorization-servers/{param}/sessions oauth2 GET /auth/rest/oauth2/authorization-servers/{param}/sessions oauth2 DELETE /auth/rest/oauth2/authorization-servers/{param}/sessions/{param} oauth2 POST /auth/rest/oauth2/authorization-servers/{param}/token oauth2 GET /auth/rest/oauth2/authorization-servers/{param}/userinfo oauth2 POST /auth/rest/oauth2/authorization-servers/{param}/userinfo oauth2 GET /auth/rest/protected/application.wadl protected GET /auth/rest/protected/application.wadl/{param} protected POST /auth/rest/protected/my/password/change protected POST /auth/rest/protected/my/secret-questions/{param}/answer protected GET /auth/rest/protected/my/self protected POST /auth/rest/protected/my/tokens/cronto/activation-letters/order protected GET /auth/rest/protected/my/tokens/cronto/devices protected POST /auth/rest/protected/my/tokens/cronto/devices/activation/complete protected POST /auth/rest/protected/my/tokens/cronto/devices/activation/start protected DELETE /auth/rest/protected/my/tokens/cronto/devices/{param} protected GET /auth/rest/protected/my/tokens/cronto/devices/{param} protected PATCH /auth/rest/protected/my/tokens/cronto/devices/{param} protected DELETE /auth/rest/protected/my/tokens/cronto/devices/{param}/enable protected POST /auth/rest/protected/my/tokens/cronto/devices/{param}/enable protected DELETE /auth/rest/protected/my/tokens/cronto/devices/{param}/push/allow protected POST /auth/rest/protected/my/tokens/cronto/devices/{param}/push/allow protected GET /auth/rest/protected/my/tokens/device-tokens protected POST /auth/rest/protected/my/tokens/device-tokens protected DELETE /auth/rest/protected/my/tokens/device-tokens/{param} protected GET /auth/rest/protected/my/tokens/mtan protected PATCH /auth/rest/protected/my/tokens/mtan/{param} protected POST /auth/rest/protected/my/tokens/mtan/{param}/start-number-change protected POST /auth/rest/protected/my/tokens/mtan/{param}/verify-number-change protected GET /auth/rest/protected/secret-questions protected GET /auth/rest/protected/self-service/account-link/providers protected POST /auth/rest/protected/self-service/account-link/providers/{param}/link protected GET /auth/rest/protected/self-service/account-links protected POST /auth/rest/protected/self-service/account-links/{param}/remove protected POST /auth/rest/protected/self-service/airlock-2fa/activation/challenge/retrieve protected POST /auth/rest/protected/self-service/airlock-2fa/activation/start protected POST /auth/rest/protected/self-service/airlock-2fa/activation/status/poll protected GET /auth/rest/protected/self-service/airlock-2fa/app-devices protected POST /auth/rest/protected/self-service/airlock-2fa/device-edit/continue protected POST /auth/rest/protected/self-service/airlock-2fa/device-edit/data protected POST /auth/rest/protected/self-service/airlock-2fa/device-edit/data/retrieve protected POST /auth/rest/protected/self-service/airlock-2fa/devices/{param}/remove protected POST /auth/rest/protected/self-service/airlock-2fa/devices/{param}/select protected GET /auth/rest/protected/self-service/airlock-2fa/hardware-devices protected POST /auth/rest/protected/self-service/airlock-2fa/recovery/start protected POST /auth/rest/protected/self-service/airlock-2fa/recovery/status/poll protected POST /auth/rest/protected/self-service/approval/airlock-2fa/devices/retrieve protected POST /auth/rest/protected/self-service/approval/airlock-2fa/devices/{param}/select protected POST /auth/rest/protected/self-service/approval/airlock-2fa/mobile-only/challenge/retrieve protected POST /auth/rest/protected/self-service/approval/airlock-2fa/offline protected POST /auth/rest/protected/self-service/approval/airlock-2fa/offline-qr-code/challenge/retrieve protected POST /auth/rest/protected/self-service/approval/airlock-2fa/offline-qr-code/otp/check protected POST /auth/rest/protected/self-service/approval/airlock-2fa/status/poll protected POST /auth/rest/protected/self-service/approval/cronto/challenge/retrieve protected POST /auth/rest/protected/self-service/approval/cronto/offline protected POST /auth/rest/protected/self-service/approval/cronto/otp/check protected POST /auth/rest/protected/self-service/approval/cronto/otp/poll protected POST /auth/rest/protected/self-service/approval/cronto/push-devices/retrieve protected POST /auth/rest/protected/self-service/approval/cronto/push-devices/{param}/select protected POST /auth/rest/protected/self-service/approval/fido/assertion-response/check protected POST /auth/rest/protected/self-service/approval/fido/challenge/retrieve protected POST /auth/rest/protected/self-service/approval/fido/failure/report protected POST /auth/rest/protected/self-service/approval/matrix/challenge/retrieve protected POST /auth/rest/protected/self-service/approval/matrix/check protected POST /auth/rest/protected/self-service/approval/mtan/otp/check protected POST /auth/rest/protected/self-service/approval/mtan/otp/resend protected POST /auth/rest/protected/self-service/approval/mtan/otp/resend-info/retrieve protected POST /auth/rest/protected/self-service/approval/mtan/tokens/retrieve protected POST /auth/rest/protected/self-service/approval/mtan/tokens/{param}/select protected POST /auth/rest/protected/self-service/approval/vasco/otp/check protected POST /auth/rest/protected/self-service/cronto/activation/challenge/retrieve protected POST /auth/rest/protected/self-service/cronto/activation/complete protected POST /auth/rest/protected/self-service/cronto/activation/start protected POST /auth/rest/protected/self-service/cronto/activation/start-challenge/retrieve protected POST /auth/rest/protected/self-service/cronto/device/edit protected POST /auth/rest/protected/self-service/cronto/device/edit/continue protected POST /auth/rest/protected/self-service/cronto/device/info/retrieve protected GET /auth/rest/protected/self-service/cronto/devices protected POST /auth/rest/protected/self-service/cronto/devices/{param}/disable protected POST /auth/rest/protected/self-service/cronto/devices/{param}/enable protected POST /auth/rest/protected/self-service/cronto/devices/{param}/push/disable protected POST /auth/rest/protected/self-service/cronto/devices/{param}/push/enable protected POST /auth/rest/protected/self-service/cronto/devices/{param}/remove protected POST /auth/rest/protected/self-service/cronto/devices/{param}/select protected POST /auth/rest/protected/self-service/cronto/push-devices/activation/challenge/retrieve protected POST /auth/rest/protected/self-service/cronto/push-devices/activation/continue protected POST /auth/rest/protected/self-service/data/continue protected POST /auth/rest/protected/self-service/data/edit protected POST /auth/rest/protected/self-service/data/info/retrieve protected POST /auth/rest/protected/self-service/data/validate protected POST /auth/rest/protected/self-service/device-token/registration/start protected GET /auth/rest/protected/self-service/device-token/tokens protected POST /auth/rest/protected/self-service/dynamic-steps/retrieve protected POST /auth/rest/protected/self-service/dynamic-steps/{param}/activate protected POST /auth/rest/protected/self-service/dynamic-steps/{param}/deactivate protected POST /auth/rest/protected/self-service/email/verification/otp/check protected POST /auth/rest/protected/self-service/fido/credential/edit protected POST /auth/rest/protected/self-service/fido/credential/edit/continue protected POST /auth/rest/protected/self-service/fido/credential/info/retrieve protected GET /auth/rest/protected/self-service/fido/credentials protected POST /auth/rest/protected/self-service/fido/credentials/{param}/disable protected POST /auth/rest/protected/self-service/fido/credentials/{param}/enable protected POST /auth/rest/protected/self-service/fido/credentials/{param}/remove protected POST /auth/rest/protected/self-service/fido/credentials/{param}/select protected POST /auth/rest/protected/self-service/fido/registration/attestation-response/check protected POST /auth/rest/protected/self-service/fido/registration/challenge/retrieve protected POST /auth/rest/protected/self-service/fido/registration/failure/report protected DELETE /auth/rest/protected/self-service/flow protected GET /auth/rest/protected/self-service/flows protected POST /auth/rest/protected/self-service/flows/{param}/select protected POST /auth/rest/protected/self-service/goto-targets/retrieve protected POST /auth/rest/protected/self-service/goto-targets/{param}/goto protected POST /auth/rest/protected/self-service/message/acknowledge protected POST /auth/rest/protected/self-service/mtan/registration/iak/check protected POST /auth/rest/protected/self-service/mtan/registration/otp/check protected POST /auth/rest/protected/self-service/mtan/registration/otp/resend protected POST /auth/rest/protected/self-service/mtan/registration/otp/resend-info/retrieve protected POST /auth/rest/protected/self-service/mtan/registration/start protected POST /auth/rest/protected/self-service/mtan/token/edit protected POST /auth/rest/protected/self-service/mtan/token/edit/continue protected POST /auth/rest/protected/self-service/mtan/token/info/retrieve protected GET /auth/rest/protected/self-service/mtan/tokens protected POST /auth/rest/protected/self-service/mtan/tokens/{param}/remove protected POST /auth/rest/protected/self-service/mtan/tokens/{param}/select protected POST /auth/rest/protected/self-service/oath/activation/complete protected POST /auth/rest/protected/self-service/oauth2/authorization-servers/{param}/clients/{param}/consents/remove protected POST /auth/rest/protected/self-service/oauth2/client/authorization/check protected POST /auth/rest/protected/self-service/oauth2/client/authorization/uri/retrieve protected GET /auth/rest/protected/self-service/oauth2/consents protected POST /auth/rest/protected/self-service/oauth2/consents/{param}/deny protected POST /auth/rest/protected/self-service/oauth2/consents/{param}/grant protected GET /auth/rest/protected/self-service/oauth2/sessions protected POST /auth/rest/protected/self-service/oauth2/sessions/{param}/remove protected POST /auth/rest/protected/self-service/password/change protected GET /auth/rest/protected/self-service/remember-me/devices protected POST /auth/rest/protected/self-service/remember-me/devices/{param}/remove protected POST /auth/rest/protected/self-service/representation/start protected POST /auth/rest/protected/self-service/selection/options/retrieve protected POST /auth/rest/protected/self-service/selection/options/{param}/select protected POST /auth/rest/protected/self-service/ssi/issuance/poll protected GET /auth/rest/protected/self-service/ui/configuration/account-links protected GET /auth/rest/protected/self-service/ui/configuration/oauth2/consents protected GET /auth/rest/protected/self-service/ui/configuration/oauth2/sessions protected GET /auth/rest/protected/self-service/ui/configuration/portal protected GET /auth/rest/protected/self-service/ui/configuration/remember-me/devices protected GET /auth/rest/protected/self-service/ui/configuration/representation protected GET /auth/rest/protected/self-service/ui/configuration/tokens/airlock-2fa protected GET /auth/rest/protected/self-service/ui/configuration/tokens/cronto protected GET /auth/rest/protected/self-service/ui/configuration/tokens/device-token protected GET /auth/rest/protected/self-service/ui/configuration/tokens/fido protected GET /auth/rest/protected/self-service/ui/configuration/tokens/mtan protected GET /auth/rest/protected/self-service/ui/on-completed/{param} protected GET /auth/rest/protected/self-service/ui/on-failure/{param} protected POST /auth/rest/protected/self-service/vasco/devices/{param}/activate protected GET /auth/rest/public/application.wadl public GET /auth/rest/public/application.wadl/{param} public DELETE /auth/rest/public/authentication public DELETE /auth/rest/public/authentication/ public GET /auth/rest/public/authentication/ public POST /auth/rest/public/authentication/airlock-2fa/activation/challenge/retrieve public POST /auth/rest/public/authentication/airlock-2fa/activation/device-edit/continue public POST /auth/rest/public/authentication/airlock-2fa/activation/device-edit/data public POST /auth/rest/public/authentication/airlock-2fa/activation/device-edit/data/retrieve public POST /auth/rest/public/authentication/airlock-2fa/activation/start public POST /auth/rest/public/authentication/airlock-2fa/activation/status/poll public POST /auth/rest/public/authentication/airlock-2fa/devices/retrieve public POST /auth/rest/public/authentication/airlock-2fa/devices/{param}/select public POST /auth/rest/public/authentication/airlock-2fa/mobile-only/challenge/retrieve public POST /auth/rest/public/authentication/airlock-2fa/offline public POST /auth/rest/public/authentication/airlock-2fa/offline-qr-code/challenge/retrieve public POST /auth/rest/public/authentication/airlock-2fa/offline-qr-code/otp/check public POST /auth/rest/public/authentication/airlock-2fa/passcode/check public POST /auth/rest/public/authentication/airlock-2fa/recovery/start public POST /auth/rest/public/authentication/airlock-2fa/recovery/status/poll public POST /auth/rest/public/authentication/airlock-2fa/status/poll public POST /auth/rest/public/authentication/airlock-2fa/zero-touch-info/retrieve public GET /auth/rest/public/authentication/application.wadl public GET /auth/rest/public/authentication/application.wadl/{param} public POST /auth/rest/public/authentication/applications/{param}/access public POST /auth/rest/public/authentication/cronto/activation/challenge/retrieve public POST /auth/rest/public/authentication/cronto/activation/complete public POST /auth/rest/public/authentication/cronto/activation/start public POST /auth/rest/public/authentication/cronto/activation/start-challenge/retrieve public POST /auth/rest/public/authentication/cronto/challenge/retrieve public POST /auth/rest/public/authentication/cronto/offline public POST /auth/rest/public/authentication/cronto/offline/ public POST /auth/rest/public/authentication/cronto/otp/check public POST /auth/rest/public/authentication/cronto/otp/poll public POST /auth/rest/public/authentication/cronto/push-devices/activation/challenge/retrieve public POST /auth/rest/public/authentication/cronto/push-devices/activation/continue public POST /auth/rest/public/authentication/cronto/push-devices/activation/never public POST /auth/rest/public/authentication/cronto/push-devices/activation/skip public POST /auth/rest/public/authentication/cronto/push-devices/retrieve public POST /auth/rest/public/authentication/cronto/push-devices/{param}/select public POST /auth/rest/public/authentication/data/continue public POST /auth/rest/public/authentication/data/edit public POST /auth/rest/public/authentication/data/info/retrieve public POST /auth/rest/public/authentication/data/validate public POST /auth/rest/public/authentication/default-application/access public POST /auth/rest/public/authentication/device-token/check public POST /auth/rest/public/authentication/device-token/registration/start public POST /auth/rest/public/authentication/device-token/{param}/challenge/retrieve public POST /auth/rest/public/authentication/dynamic-steps/retrieve public POST /auth/rest/public/authentication/dynamic-steps/{param}/activate public POST /auth/rest/public/authentication/dynamic-steps/{param}/deactivate public POST /auth/rest/public/authentication/email/otp/check public POST /auth/rest/public/authentication/email/otp/resend public POST /auth/rest/public/authentication/email/verification/otp/check public POST /auth/rest/public/authentication/fido/assertion-response/check public POST /auth/rest/public/authentication/fido/challenge/retrieve public POST /auth/rest/public/authentication/fido/credential/edit public POST /auth/rest/public/authentication/fido/credential/edit/continue public POST /auth/rest/public/authentication/fido/failure/report public POST /auth/rest/public/authentication/fido/registration/attestation-response/check public POST /auth/rest/public/authentication/fido/registration/challenge/retrieve public POST /auth/rest/public/authentication/fido/registration/failure/report public DELETE /auth/rest/public/authentication/flow public POST /auth/rest/public/authentication/goto-targets/retrieve public POST /auth/rest/public/authentication/goto-targets/{param}/goto public POST /auth/rest/public/authentication/kerberos/not-possible public POST /auth/rest/public/authentication/location/access public POST /auth/rest/public/authentication/location/interpret public POST /auth/rest/public/authentication/matrix/challenge/retrieve public POST /auth/rest/public/authentication/matrix/check public POST /auth/rest/public/authentication/message/acknowledge public POST /auth/rest/public/authentication/migration/options/reject public POST /auth/rest/public/authentication/migration/options/retrieve public POST /auth/rest/public/authentication/migration/options/skip public POST /auth/rest/public/authentication/migration/options/{param}/select public POST /auth/rest/public/authentication/mtan/otp/check public POST /auth/rest/public/authentication/mtan/otp/resend public POST /auth/rest/public/authentication/mtan/otp/resend-info/retrieve public POST /auth/rest/public/authentication/mtan/registration/iak/check public POST /auth/rest/public/authentication/mtan/registration/info/retrieve public POST /auth/rest/public/authentication/mtan/registration/otp/check public POST /auth/rest/public/authentication/mtan/registration/otp/resend public POST /auth/rest/public/authentication/mtan/registration/otp/resend-info/retrieve public POST /auth/rest/public/authentication/mtan/registration/start public POST /auth/rest/public/authentication/mtan/tokens/retrieve public POST /auth/rest/public/authentication/mtan/tokens/{param}/select public POST /auth/rest/public/authentication/oath/activation/complete public POST /auth/rest/public/authentication/oath/otp/check public POST /auth/rest/public/authentication/oauth2/authorization-server/consent/local/deny public POST /auth/rest/public/authentication/oauth2/authorization-server/consent/local/grant public POST /auth/rest/public/authentication/oauth2/authorization-server/consent/local/retrieve public POST /auth/rest/public/authentication/oauth2/authorization-server/consent/remote/check public GET /auth/rest/public/authentication/oauth2/authorization-servers/{param}/authorize public POST /auth/rest/public/authentication/oauth2/authorization-servers/{param}/authorize public POST /auth/rest/public/authentication/oauth2/client/authorization/check public POST /auth/rest/public/authentication/oauth2/client/authorization/uri/retrieve public POST /auth/rest/public/authentication/otp/check public POST /auth/rest/public/authentication/password-only/check public POST /auth/rest/public/authentication/password/change public POST /auth/rest/public/authentication/password/check public POST /auth/rest/public/authentication/password/set public POST /auth/rest/public/authentication/saml2/idp/sso/init public POST /auth/rest/public/authentication/saml2/sp/sso/init public POST /auth/rest/public/authentication/secret-questions/provision public POST /auth/rest/public/authentication/secret-questions/status/retrieve public POST /auth/rest/public/authentication/selection/options/retrieve public POST /auth/rest/public/authentication/selection/options/{param}/select public POST /auth/rest/public/authentication/ssi/invitation/poll public POST /auth/rest/public/authentication/ssi/issuance/poll public POST /auth/rest/public/authentication/ssi/verification/poll public POST /auth/rest/public/authentication/terms-of-services/accept-retrieved public POST /auth/rest/public/authentication/terms-of-services/deny-retrieved public POST /auth/rest/public/authentication/terms-of-services/retrieve public GET /auth/rest/public/authentication/ui/configuration/access public GET /auth/rest/public/authentication/ui/configuration/logout public GET /auth/rest/public/authentication/ui/configuration/oauth2/authorization-servers/{param}/session-management public GET /auth/rest/public/authentication/ui/default/application/id public GET /auth/rest/public/authentication/ui/non-flow/configuration public GET /auth/rest/public/authentication/ui/on-failure/{param} public POST /auth/rest/public/authentication/user/identify public POST /auth/rest/public/authentication/username/identify public POST /auth/rest/public/authentication/vasco/otp/check public POST /auth/rest/public/baloise/saml2/transform public GET /auth/rest/public/flow public GET /auth/rest/public/jwks public GET /auth/rest/public/maintenance-messages public POST /auth/rest/public/password/policy/check public GET /auth/rest/public/self-service/application.wadl public GET /auth/rest/public/self-service/application.wadl/{param} public POST /auth/rest/public/self-service/approval/airlock-2fa/devices/retrieve public POST /auth/rest/public/self-service/approval/airlock-2fa/devices/{param}/select public POST /auth/rest/public/self-service/approval/airlock-2fa/mobile-only/challenge/retrieve public POST /auth/rest/public/self-service/approval/airlock-2fa/mobile-only/challenge/retrieve/ public POST /auth/rest/public/self-service/approval/airlock-2fa/offline public POST /auth/rest/public/self-service/approval/airlock-2fa/offline-qr-code/challenge/retrieve public POST /auth/rest/public/self-service/approval/airlock-2fa/offline-qr-code/otp/check public POST /auth/rest/public/self-service/approval/airlock-2fa/offline/ public POST /auth/rest/public/self-service/approval/airlock-2fa/status/poll public POST /auth/rest/public/self-service/approval/cronto/challenge/retrieve public POST /auth/rest/public/self-service/approval/cronto/offline public POST /auth/rest/public/self-service/approval/cronto/offline/ public POST /auth/rest/public/self-service/approval/cronto/otp/check public POST /auth/rest/public/self-service/approval/cronto/otp/poll public POST /auth/rest/public/self-service/approval/cronto/push-devices/retrieve public POST /auth/rest/public/self-service/approval/cronto/push-devices/{param}/select public POST /auth/rest/public/self-service/approval/fido/assertion-response/check public POST /auth/rest/public/self-service/approval/fido/challenge/retrieve public POST /auth/rest/public/self-service/approval/fido/failure/report public POST /auth/rest/public/self-service/approval/matrix/challenge/retrieve public POST /auth/rest/public/self-service/approval/matrix/check public POST /auth/rest/public/self-service/approval/mtan/otp/check public POST /auth/rest/public/self-service/approval/mtan/otp/resend public POST /auth/rest/public/self-service/approval/mtan/otp/resend-info/retrieve public POST /auth/rest/public/self-service/approval/mtan/tokens/retrieve public POST /auth/rest/public/self-service/approval/mtan/tokens/{param}/select public POST /auth/rest/public/self-service/approval/vasco/otp/check public POST /auth/rest/public/self-service/device-token/check public POST /auth/rest/public/self-service/device-token/{param}/challenge/retrieve public POST /auth/rest/public/self-service/dynamic-steps/retrieve public POST /auth/rest/public/self-service/dynamic-steps/{param}/activate public POST /auth/rest/public/self-service/dynamic-steps/{param}/deactivate public DELETE /auth/rest/public/self-service/flow public POST /auth/rest/public/self-service/flows/{param}/select public POST /auth/rest/public/self-service/goto-targets/retrieve public POST /auth/rest/public/self-service/goto-targets/{param}/goto public POST /auth/rest/public/self-service/message/acknowledge public POST /auth/rest/public/self-service/password/set public POST /auth/rest/public/self-service/selection/options/retrieve public POST /auth/rest/public/self-service/selection/options/{param}/select public POST /auth/rest/public/self-service/ssi/invitation/poll public POST /auth/rest/public/self-service/ssi/verification/poll public GET /auth/rest/public/self-service/ui/on-completed/{param} public GET /auth/rest/public/self-service/ui/on-failure/{param} public POST /auth/rest/public/self-service/user/identify public POST /auth/rest/public/self-service/username/identify public POST /auth/rest/public/self-service/verification/email/otp/check public POST /auth/rest/public/self-service/verification/mtan/otp/check public POST /auth/rest/public/self-service/verification/secret-questions/answer public POST /auth/rest/public/self-service/verification/secret-questions/retrieve public GET /auth/rest/public/tech-client-registration/application.wadl public GET /auth/rest/public/tech-client-registration/application.wadl/{param} public POST /auth/rest/public/tech-client-registration/dynamic-steps/retrieve public POST /auth/rest/public/tech-client-registration/dynamic-steps/{param}/activate public POST /auth/rest/public/tech-client-registration/dynamic-steps/{param}/deactivate public POST /auth/rest/public/tech-client-registration/goto-targets/retrieve public POST /auth/rest/public/tech-client-registration/goto-targets/{param}/goto public POST /auth/rest/public/tech-client-registration/oauth2/{param}/register public GET /auth/rest/public/ui/languages public GET /auth/rest/public/ui/static/configuration public POST /auth/rest/public/user-self-registration/airlock-2fa/activation/challenge/retrieve public POST /auth/rest/public/user-self-registration/airlock-2fa/activation/status/poll public GET /auth/rest/public/user-self-registration/application.wadl public GET /auth/rest/public/user-self-registration/application.wadl/{param} public POST /auth/rest/public/user-self-registration/default-flow/select public POST /auth/rest/public/user-self-registration/dynamic-steps/retrieve public POST /auth/rest/public/user-self-registration/dynamic-steps/{param}/activate public POST /auth/rest/public/user-self-registration/dynamic-steps/{param}/deactivate public DELETE /auth/rest/public/user-self-registration/flow public POST /auth/rest/public/user-self-registration/flows/{param}/select public POST /auth/rest/public/user-self-registration/goto-targets/retrieve public POST /auth/rest/public/user-self-registration/goto-targets/{param}/goto public POST /auth/rest/public/user-self-registration/message/acknowledge public POST /auth/rest/public/user-self-registration/oath/activation/complete public POST /auth/rest/public/user-self-registration/registration/continue public POST /auth/rest/public/user-self-registration/registration/data public POST /auth/rest/public/user-self-registration/registration/info/retrieve public POST /auth/rest/public/user-self-registration/registration/validate public POST /auth/rest/public/user-self-registration/selection/options/retrieve public POST /auth/rest/public/user-self-registration/selection/options/{param}/select public POST /auth/rest/public/user-self-registration/ssi/invitation/poll public POST /auth/rest/public/user-self-registration/ssi/verification/poll public POST /auth/rest/public/user-self-registration/terms-of-services/accept-retrieved public POST /auth/rest/public/user-self-registration/terms-of-services/deny-retrieved public POST /auth/rest/public/user-self-registration/terms-of-services/retrieve public GET /auth/rest/public/user-self-registration/ui/default/flow/id public GET /auth/rest/public/user-self-registration/ui/on-completed/{param} public GET /auth/rest/public/user-self-registration/ui/on-failure/{param} public POST /auth/rest/public/user-self-registration/verification/email/otp/check public POST /auth/rest/public/user-self-registration/verification/phone-number/otp/check public POST /auth/rest/public/user-self-registration/verification/phone-number/otp/resend public POST /auth/rest/public/{param}/terms-of-services/accept-retrieved public POST /auth/rest/public/{param}/terms-of-services/deny-retrieved public POST /auth/rest/public/{param}/terms-of-services/retrieve public ## Excluded source names template reason /auth/rest/protected/self-service composition prefix; GET 404 /auth/rest/public/authentication/ui/on-failure requires /{flowId}; bare path GET 404 /auth/rest/public/self-service composition prefix; GET 404 /auth/rest/public/self-service/ui/on-failure requires /{flowId}; bare path GET 404 /auth/rest/public/user-self-registration composition prefix; GET 404 /auth/rest/public/user-self-registration/selection/options non-handler source prefix; GET 404 /auth/rest/public/user-self-registration/ui/on-completed requires /{flowId}; bare path GET 404 /auth/rest/public/user-self-registration/ui/on-failure requires /{flowId}; bare path GET 404 ## Evidence sets - original client routes and contracts: `recon/airlock-registration-source-routes-v8.txt` and `recon/airlock-registration-api-contracts-v5.txt` - 112-candidate product classification: `recon/airlock-registration-product-route-expansion-v1.txt` - 61 segment-array management/OAuth additions: `recon/airlock-dynamic-management-route-expansion-v1.txt` - four-tenant parity: `recon/airlock-dynamic-route-parity-v1.txt` - dynamic-step families: `recon/airlock-dynamic-step-routes-v1.txt` - offline Airlock 2FA method confirmation: `recon/airlock-offline-route-methods-v1.txt` - server-only and legacy route expansion: `recon/airlock-server-only-route-expansion-v1.txt`