# Airlock IAM product-route expansion on mein-portal-registrierung.baloise.de
# Date: 2026-11-09
# Product source: product/airlock-iam-web-ui/unversioned

The complete generic Airlock IAM UI source contains 136 normalized REST endpoint literals. After subtracting the 60 paths already represented by the tenant bundle/map, 112 product-supported candidate paths remained. Each candidate received a read-only OPTIONS request in a normal anonymous session with mirrored CSRF state. Random same-prefix controls returned JSON:API 404 (132 bytes).

Results:
- 54 public routes returned 200 with `Allow: POST,OPTIONS`, confirming exact POST handlers.
- 33 protected self-service routes returned 401 before method dispatch, confirming route existence behind authentication.
- 25 candidates returned the same 404 class as controls and are excluded from the active tenant map.
- No POST operation was invoked.

## Confirmed public POST handlers

path | evidence
--- | ---
`POST /auth/rest/public/authentication/airlock-2fa/activation/device-edit/continue` | `01a1c1b3-a64e-72c7-be44-109660b98f81`
`POST /auth/rest/public/authentication/airlock-2fa/activation/device-edit/data` | `01a1c1b3-a5b6-703f-85ae-06173752401a`
`POST /auth/rest/public/authentication/airlock-2fa/activation/status/poll` | `01a1c1b3-a67c-733c-aaaf-a8aa10aceaf7`
`POST /auth/rest/public/authentication/airlock-2fa/offline-qr-code/otp/check` | `01a1c1b3-a69b-7366-af64-be284690f05b`
`POST /auth/rest/public/authentication/airlock-2fa/passcode/check` | `01a1c1b3-a70e-7300-b416-6e38fd496e58`
`POST /auth/rest/public/authentication/cronto/activation/complete` | `01a1c1b3-a75b-7790-82da-3acf12499100`
`POST /auth/rest/public/authentication/cronto/activation/start` | `01a1c1b3-a81d-77fb-bcd5-6e10f01333dc`
`POST /auth/rest/public/authentication/cronto/offline` | `01a1c1b3-a7c9-703c-9f65-b42f8e13ea8e`
`POST /auth/rest/public/authentication/cronto/otp/check` | `01a1c1b3-a839-75df-bd36-ebb21b8e1e91`
`POST /auth/rest/public/authentication/cronto/otp/poll` | `01a1c1b3-a826-7355-9439-435247651fba`
`POST /auth/rest/public/authentication/cronto/push-devices/activation/continue` | `01a1c1b3-a8d3-72ec-a2f2-0abda634749c`
`POST /auth/rest/public/authentication/cronto/push-devices/activation/never` | `01a1c1b3-a869-744c-8bf6-1d9d028861b7`
`POST /auth/rest/public/authentication/cronto/push-devices/activation/skip` | `01a1c1b3-a8e3-74ef-87a4-164b9dc2eb4f`
`POST /auth/rest/public/authentication/email/otp/check` | `01a1c1b3-a8ff-766f-b0b5-29f099c240cf`
`POST /auth/rest/public/authentication/email/otp/resend` | `01a1c1b3-a920-71bb-90bf-2ef5fc5a72ba`
`POST /auth/rest/public/authentication/email/verification/otp/check` | `01a1c1b3-a989-7710-b3ee-59be2a2c7aaf`
`POST /auth/rest/public/authentication/fido/credential/edit` | `01a1c1b3-aa88-706b-9459-344ba3187284`
`POST /auth/rest/public/authentication/fido/credential/edit/continue` | `01a1c1b3-aa2f-705a-9124-5352615914ef`
`POST /auth/rest/public/authentication/fido/registration/attestation-response/check` | `01a1c1b3-aae7-75a0-a0b8-4a589401ae69`
`POST /auth/rest/public/authentication/fido/registration/challenge/retrieve` | `01a1c1b3-aa58-73ea-b3ea-1988b060ce87`
`POST /auth/rest/public/authentication/fido/registration/failure/report` | `01a1c1b3-ab01-74fa-9494-e9d88b9b5b0d`
`POST /auth/rest/public/authentication/matrix/check` | `01a1c1b3-ab0f-775f-b593-6a94c2e321a8`
`POST /auth/rest/public/authentication/message/acknowledge` | `01a1c1b3-ab23-7199-bf45-b4e524305bcd`
`POST /auth/rest/public/authentication/mtan/otp/check` | `01a1c1b3-ab45-7310-85be-cbbd128fdd4b`
`POST /auth/rest/public/authentication/mtan/otp/resend` | `01a1c1b3-ab63-73f2-a3bf-847099b63cdb`
`POST /auth/rest/public/authentication/mtan/registration/iak/check` | `01a1c1b3-ac58-7051-8fde-fa242fe849ba`
`POST /auth/rest/public/authentication/mtan/registration/otp/check` | `01a1c1b3-acb2-70ad-bf1e-e64f91291ba0`
`POST /auth/rest/public/authentication/mtan/registration/otp/resend` | `01a1c1b3-ad2b-71b9-a5de-14de8c305901`
`POST /auth/rest/public/authentication/oath/activation/complete` | `01a1c1b3-ad72-742b-a48d-bcd96f70e597`
`POST /auth/rest/public/authentication/oath/otp/check` | `01a1c1b3-ada4-756d-ae02-ada58df242ff`
`POST /auth/rest/public/authentication/otp/check` | `01a1c1b3-adca-722d-bbe9-8f345c2fb900`
`POST /auth/rest/public/authentication/password/change` | `01a1c1b3-ae61-723a-9f0a-4cdb7f5a555e`
`POST /auth/rest/public/authentication/selection/options/retrieve` | `01a1c1b3-ae1b-761c-9208-4ae655ea0bcf`
`POST /auth/rest/public/authentication/ssi/issuance/poll` | `01a1c1b3-ae82-7552-a3c8-36fa14d80eab`
`POST /auth/rest/public/authentication/ssi/verification/poll` | `01a1c1b3-af01-75c2-92f1-fcda779f1a4f`
`POST /auth/rest/public/authentication/user/identify` | `01a1c1b3-af4d-7119-974a-39aa08672b18`
`POST /auth/rest/public/authentication/vasco/otp/check` | `01a1c1b3-af81-7535-be22-9127487c3d60`
`POST /auth/rest/public/self-service/approval/airlock-2fa/offline-qr-code/otp/check` | `01a1c1b3-b826-72f4-841b-2be79fad1c34`
`POST /auth/rest/public/self-service/approval/cronto/offline` | `01a1c1b3-b84f-72b8-8a0f-6036775f60dd`
`POST /auth/rest/public/self-service/approval/cronto/otp/check` | `01a1c1b3-b8b1-7083-9ae7-2d3790e1bf29`
`POST /auth/rest/public/self-service/approval/cronto/otp/poll` | `01a1c1b3-b8d6-7511-a2bf-10904dca2335`
`POST /auth/rest/public/self-service/approval/fido/assertion-response/check` | `01a1c1b3-b96a-71be-86b7-1ecd6fbfb116`
`POST /auth/rest/public/self-service/approval/fido/failure/report` | `01a1c1b3-b986-70d1-8f27-8c84077ff113`
`POST /auth/rest/public/self-service/approval/matrix/check` | `01a1c1b3-b9bc-777c-b7bd-1f379b23e6b5`
`POST /auth/rest/public/self-service/approval/mtan/otp/check` | `01a1c1b3-bf00-73f5-8580-4ca0326adf71`
`POST /auth/rest/public/self-service/approval/mtan/otp/resend` | `01a1c1b3-bf0e-768f-afa4-b2b8adabb7ed`
`POST /auth/rest/public/self-service/approval/vasco/otp/check` | `01a1c1b3-c1f5-7173-9e9a-eaa17ff8ddfa`
`POST /auth/rest/public/self-service/message/acknowledge` | `01a1c1b3-c27e-74c5-99cd-dcba579dfcab`
`POST /auth/rest/public/self-service/selection/options/retrieve` | `01a1c1b3-c32c-720e-9741-006ba0237951`
`POST /auth/rest/public/self-service/ssi/verification/poll` | `01a1c1b3-c343-748a-9fe2-ec0c334609f4`
`POST /auth/rest/public/self-service/verification/email/otp/check` | `01a1c1b3-c529-724f-a5b3-2b1d7f238fa3`
`POST /auth/rest/public/self-service/verification/mtan/otp/check` | `01a1c1b3-c8b7-751f-8756-e948a78c92d9`
`POST /auth/rest/public/user-self-registration/default-flow/select` | `01a1c1b3-c11a-753b-8297-effcf3944405`
`POST /auth/rest/public/user-self-registration/ssi/verification/poll` | `01a1c1b3-c3c7-715e-b29a-7062aee8ee89`

## Confirmed protected route boundaries

OPTIONS reaches the protected 401 boundary before method dispatch; methods remain product-source-defined rather than live-confirmed.

path | evidence
--- | ---
`/auth/rest/protected/self-service/airlock-2fa/activation/status/poll` | `01a1c1b3-9e69-7125-a7dc-d2febfd25e1b`
`/auth/rest/protected/self-service/airlock-2fa/device-edit/continue` | `01a1c1b3-9df5-711a-8d63-c5298507aa29`
`/auth/rest/protected/self-service/airlock-2fa/device-edit/data` | `01a1c1b3-9d0d-7714-a9e7-72b6129dfd18`
`/auth/rest/protected/self-service/approval/airlock-2fa/offline-qr-code/otp/check` | `01a1c1b3-9d4e-7239-85da-a2a8e5715eb2`
`/auth/rest/protected/self-service/approval/cronto/offline` | `01a1c1b3-9e5f-7361-9a2a-e5c6adbe2409`
`/auth/rest/protected/self-service/approval/cronto/otp/check` | `01a1c1b3-9d41-7205-9ca4-0925e8b3f021`
`/auth/rest/protected/self-service/approval/cronto/otp/poll` | `01a1c1b3-9d93-71e3-85f9-7d45aeed0f63`
`/auth/rest/protected/self-service/approval/fido/assertion-response/check` | `01a1c1b3-9d1e-7502-96af-2c2647750119`
`/auth/rest/protected/self-service/approval/fido/failure/report` | `01a1c1b3-9e6c-71c3-a11c-e3f4f85c66b8`
`/auth/rest/protected/self-service/approval/matrix/check` | `01a1c1b3-9f4c-766e-ab0a-6241edf07202`
`/auth/rest/protected/self-service/approval/mtan/otp/check` | `01a1c1b3-9f97-7583-a9f4-99c579fa839e`
`/auth/rest/protected/self-service/approval/mtan/otp/resend` | `01a1c1b3-9fc8-70a9-abfc-d13e47b9ae65`
`/auth/rest/protected/self-service/approval/vasco/otp/check` | `01a1c1b3-a1cd-75f8-90d1-6ac3a41a9632`
`/auth/rest/protected/self-service/cronto/activation/complete` | `01a1c1b3-a2b6-71eb-906b-446ef63df757`
`/auth/rest/protected/self-service/cronto/activation/start` | `01a1c1b3-a082-7510-84a9-f503ed8ebcf1`
`/auth/rest/protected/self-service/cronto/device/edit` | `01a1c1b3-a1d7-7518-bb4b-4f25c48fd7ac`
`/auth/rest/protected/self-service/cronto/device/edit/continue` | `01a1c1b3-a201-7079-b3c7-5edaf1f17eb4`
`/auth/rest/protected/self-service/cronto/device/info/retrieve` | `01a1c1b3-a07c-77d8-8cde-05506e5f5f71`
`/auth/rest/protected/self-service/cronto/push-devices/activation/continue` | `01a1c1b3-a0a8-740b-9af5-8b5f77230960`
`/auth/rest/protected/self-service/email/verification/otp/check` | `01a1c1b3-a177-7219-a8f4-5dd4b2d2391d`
`/auth/rest/protected/self-service/fido/credential/edit` | `01a1c1b3-a1aa-7233-9be1-550dcedb9981`
`/auth/rest/protected/self-service/fido/credential/edit/continue` | `01a1c1b3-a1c1-7399-b556-848a3983bb24`
`/auth/rest/protected/self-service/fido/registration/attestation-response/check` | `01a1c1b3-a29b-7451-9c7c-69473430c0aa`
`/auth/rest/protected/self-service/fido/registration/challenge/retrieve` | `01a1c1b3-a28e-7152-a9d4-47724d54e6a4`
`/auth/rest/protected/self-service/fido/registration/failure/report` | `01a1c1b3-a2ae-71f6-aa3b-0fc5532a2573`
`/auth/rest/protected/self-service/message/acknowledge` | `01a1c1b3-a34c-748c-b84d-fb0767143df6`
`/auth/rest/protected/self-service/mtan/registration/iak/check` | `01a1c1b3-a3e5-77be-8cbb-c173767204d3`
`/auth/rest/protected/self-service/mtan/registration/otp/check` | `01a1c1b3-a59e-773a-abbf-37ff57c50f3f`
`/auth/rest/protected/self-service/mtan/registration/otp/resend` | `01a1c1b3-a44d-7295-9d4f-a9ce26581319`
`/auth/rest/protected/self-service/oath/activation/complete` | `01a1c1b3-a3de-75ff-b8dc-e67f3cd78b72`
`/auth/rest/protected/self-service/password/change` | `01a1c1b3-a43b-73f9-9cf3-ba0c37705991`
`/auth/rest/protected/self-service/selection/options/retrieve` | `01a1c1b3-a5ac-737f-bc5c-00a002ba08ef`
`/auth/rest/protected/self-service/ssi/issuance/poll` | `01a1c1b3-a4d4-70b6-8ad4-29e3220c6ccb`

## Inactive product candidates excluded from the tenant map

- `/auth/rest/protected/flow/mapping-control` (`01a1c1b3-a544-72ac-9544-4ea2b74219f9`)
- `/auth/rest/protected/self-service/approval/airlock-2fa/devices` (`01a1c1b3-9d7e-7207-bb0d-a13fdb762033`)
- `/auth/rest/protected/self-service/approval/airlock-2fa/passcode/check` (`01a1c1b3-9d23-73c2-ad8a-e434b1b8cd7e`)
- `/auth/rest/protected/self-service/approval/cronto/push-devices` (`01a1c1b3-9c7b-73a7-af83-c0bebc9670df`)
- `/auth/rest/protected/self-service/approval/mtan/tokens` (`01a1c1b3-a1e7-71ff-8a70-156f56479d4e`)
- `/auth/rest/protected/self-service/selection/options` (`01a1c1b3-a474-7045-95ff-89c754d3ce0a`)
- `/auth/rest/protected/self-service/ssi/verification/poll` (`01a1c1b3-a4c3-72a5-b330-0334e617a5db`)
- `/auth/rest/protected/self-service/ui/on-completed` (`01a1c1b3-a4b2-7600-8427-6c22da1574ee`)
- `/auth/rest/protected/self-service/ui/on-failure` (`01a1c1b3-a521-7777-8979-79867cea0c05`)
- `/auth/rest/public/authentication/airlock-2fa/devices` (`01a1c1b3-afdd-7528-9230-b9350fab75cd`)
- `/auth/rest/public/authentication/applications` (`01a1c1b3-b02b-708e-94d9-9ccc1ea6f8c3`)
- `/auth/rest/public/authentication/cronto/push-devices` (`01a1c1b3-afc2-7632-9548-5a51aed343d9`)
- `/auth/rest/public/authentication/mtan/tokens` (`01a1c1b3-b567-769a-8d05-7d6d3077f6bd`)
- `/auth/rest/public/authentication/selection/options` (`01a1c1b3-b57b-7371-a5d6-877558bec2df`)
- `/auth/rest/public/self-service/approval/airlock-2fa/devices` (`01a1c1b3-b7f7-74f8-8552-6363675f20f5`)
- `/auth/rest/public/self-service/approval/airlock-2fa/passcode/check` (`01a1c1b3-b831-7198-8782-49909bfef49b`)
- `/auth/rest/public/self-service/approval/cronto/push-devices` (`01a1c1b3-b908-7333-aae0-ab96b5f0fd2a`)
- `/auth/rest/public/self-service/approval/mtan/tokens` (`01a1c1b3-c186-765d-a856-ea9cff9976bc`)
- `/auth/rest/public/self-service/approval/oath/otp/check` (`01a1c1b3-c1dc-71f2-a7c6-0cbecaef59b9`)
- `/auth/rest/public/self-service/flow/continue` (`01a1c1b3-c219-777f-9dc7-24abdcc851dc`)
- `/auth/rest/public/self-service/flows` (`01a1c1b3-c265-7496-a936-911766d0e530`)
- `/auth/rest/public/self-service/selection/options` (`01a1c1b3-c2ba-76fc-a09f-0b91bb1e7f48`)
- `/auth/rest/public/self-service/ui/on-completed` (`01a1c1b3-bb8c-728a-b2ab-12fa11d3b56c`)
- `/auth/rest/public/user-self-registration/flows` (`01a1c1b3-cae2-70e9-b68a-939d315bfdb6`)
- `/auth/rest/public/user-self-registration/ssi/issuance/poll` (`01a1c1b3-cb33-7662-96bc-df98c5a74b41`)

## Families added

The active expansion covers Airlock 2FA device/activation/passcode/offline QR, Cronto activation/offline/OTP/push, email and mTAN OTP, FIDO credential/registration/assertion flows, OATH/VASCO/matrix checks, password changes, option retrieval, SSI polling, acknowledgement and identity handlers across authentication, self-service and protected self-service.