# Airlock IAM dynamic-step activation routes
# Date: 2026-11-09

Complete production-bundle analysis found four flow-type URL builders that append `dynamic-steps/{stepId}/{activate|deactivate}` and submit a null-body POST. This yields eight exact route templates.

Six public handlers advertise `POST,OPTIONS`; the two protected self-service handlers return 401 before method dispatch. All four German tenants produce the identical path-by-path result. No POST operation was invoked.

## Routes

POST /auth/rest/public/authentication/dynamic-steps/{stepId}/activate
POST /auth/rest/public/authentication/dynamic-steps/{stepId}/deactivate
POST /auth/rest/protected/self-service/dynamic-steps/{stepId}/activate
POST /auth/rest/protected/self-service/dynamic-steps/{stepId}/deactivate
POST /auth/rest/public/self-service/dynamic-steps/{stepId}/activate
POST /auth/rest/public/self-service/dynamic-steps/{stepId}/deactivate
POST /auth/rest/public/user-self-registration/dynamic-steps/{stepId}/activate
POST /auth/rest/public/user-self-registration/dynamic-steps/{stepId}/deactivate

## Source

Retained set: `engagement/p_bugbounty_ch_baloise_germany_1dfb7802/baloise-germany-airlock-registration-full-20261109`.
Implementation: `main.8147f814d41c9c04.js`, dynamic-step activation service and its `getUrlByFlowType` dispatcher.

## Exact evidence

host	request_path	status	allow	exchange_id
mein-portal-registrierung.baloise.de	/auth/rest/public/authentication/dynamic-steps/test/activate	200	POST,OPTIONS	01a1c214-167f-7546-b757-acb0b1b03442
mein-portal-registrierung.baloise.de	/auth/rest/public/authentication/dynamic-steps/test/deactivate	200	POST,OPTIONS	01a1c214-16b1-7353-8a53-1d7ff4b07182
mein-portal-registrierung.baloise.de	/auth/rest/protected/self-service/dynamic-steps/test/activate	401		01a1c214-18d8-7220-ac32-c3a12bb77289
mein-portal-registrierung.baloise.de	/auth/rest/protected/self-service/dynamic-steps/test/deactivate	401		01a1c214-167a-7482-a081-9f12586b94f0
mein-portal-registrierung.baloise.de	/auth/rest/public/self-service/dynamic-steps/test/activate	200	POST,OPTIONS	01a1c214-1e8a-71c5-8a22-93bada504d39
mein-portal-registrierung.baloise.de	/auth/rest/public/self-service/dynamic-steps/test/deactivate	200	POST,OPTIONS	01a1c214-1e23-745c-8d19-368bcb372cd9
mein-portal-registrierung.baloise.de	/auth/rest/public/user-self-registration/dynamic-steps/test/activate	200	POST,OPTIONS	01a1c214-16a6-7359-af7b-6cc9b9982c7a
mein-portal-registrierung.baloise.de	/auth/rest/public/user-self-registration/dynamic-steps/test/deactivate	200	POST,OPTIONS	01a1c214-16d9-743c-8392-d350cc7917bc
mein-portal.baloise.de	/auth/rest/public/authentication/dynamic-steps/test/activate	200	POST,OPTIONS	01a1c214-2395-7250-bcbb-c8b70b4a21e7
mein-portal.baloise.de	/auth/rest/public/authentication/dynamic-steps/test/deactivate	200	POST,OPTIONS	01a1c214-2373-763a-bb91-8013c9693c79
mein-portal.baloise.de	/auth/rest/protected/self-service/dynamic-steps/test/activate	401		01a1c214-2377-7297-b6f7-b6c77bbb8281
mein-portal.baloise.de	/auth/rest/protected/self-service/dynamic-steps/test/deactivate	401		01a1c214-23cb-70ba-8987-f1725910d6fa
mein-portal.baloise.de	/auth/rest/public/self-service/dynamic-steps/test/activate	200	POST,OPTIONS	01a1c214-2b36-766d-8840-b156b137b360
mein-portal.baloise.de	/auth/rest/public/self-service/dynamic-steps/test/deactivate	200	POST,OPTIONS	01a1c214-2b1d-7541-a4b4-a13cb4832f11
mein-portal.baloise.de	/auth/rest/public/user-self-registration/dynamic-steps/test/activate	200	POST,OPTIONS	01a1c214-2399-779d-870d-a1ed86155c0b
mein-portal.baloise.de	/auth/rest/public/user-self-registration/dynamic-steps/test/deactivate	200	POST,OPTIONS	01a1c214-22cf-7445-b169-320811b99dca
infoportal.baloise.de	/auth/rest/public/authentication/dynamic-steps/test/activate	200	POST,OPTIONS	01a1c214-30ad-7655-b3a7-56ec5811d78d
infoportal.baloise.de	/auth/rest/public/authentication/dynamic-steps/test/deactivate	200	POST,OPTIONS	01a1c214-3099-739c-bbf6-f96a491ed0a0
infoportal.baloise.de	/auth/rest/protected/self-service/dynamic-steps/test/activate	401		01a1c214-3002-755a-b6ff-3c2d24d88eb3
infoportal.baloise.de	/auth/rest/protected/self-service/dynamic-steps/test/deactivate	401		01a1c214-30c6-720e-9003-9a6851263f87
infoportal.baloise.de	/auth/rest/public/self-service/dynamic-steps/test/activate	200	POST,OPTIONS	01a1c214-3821-7249-8b6e-89efc813eede
infoportal.baloise.de	/auth/rest/public/self-service/dynamic-steps/test/deactivate	200	POST,OPTIONS	01a1c214-386d-75ea-81c7-605f61507b1f
infoportal.baloise.de	/auth/rest/public/user-self-registration/dynamic-steps/test/activate	200	POST,OPTIONS	01a1c214-3118-7576-92c7-b3a04ef639bb
infoportal.baloise.de	/auth/rest/public/user-self-registration/dynamic-steps/test/deactivate	200	POST,OPTIONS	01a1c214-30bc-7680-bda7-72c9d7946b0c
va.baloise.de	/auth/rest/public/authentication/dynamic-steps/test/activate	200	POST,OPTIONS	01a1c214-3d8d-733d-9bfe-f399adeb1ce2
va.baloise.de	/auth/rest/public/authentication/dynamic-steps/test/deactivate	200	POST,OPTIONS	01a1c214-3d01-7705-af92-ceedd682d8e3
va.baloise.de	/auth/rest/protected/self-service/dynamic-steps/test/activate	401		01a1c214-3d32-765b-b5a5-edadf3fd0708
va.baloise.de	/auth/rest/protected/self-service/dynamic-steps/test/deactivate	401		01a1c214-3d9a-7391-a6d2-09539b6d5170
va.baloise.de	/auth/rest/public/self-service/dynamic-steps/test/activate	200	POST,OPTIONS	01a1c214-4512-70e3-af43-375e3465fdc0
va.baloise.de	/auth/rest/public/self-service/dynamic-steps/test/deactivate	200	POST,OPTIONS	01a1c214-450f-7016-b54a-6adf6310eb9e
va.baloise.de	/auth/rest/public/user-self-registration/dynamic-steps/test/activate	200	POST,OPTIONS	01a1c214-3cda-74ad-b3cd-91d13b9969d5
va.baloise.de	/auth/rest/public/user-self-registration/dynamic-steps/test/deactivate	200	POST,OPTIONS	01a1c214-3d8c-7526-b146-e4613c37b7e4