# Airlock IAM Angular client route and method inventory
# Source: complete 39-bundle capture from https://mein-portal-registrierung.baloise.de/auth/ui/
# Retained source set: baloise-germany-airlock-registration-complete
# 55 route templates were recovered. Methods below are directly recoverable from Angular HttpClient calls; the remaining paths are retained as templates where minified wrapper composition obscures the method.

# Source-recovered method bindings
DELETE /auth/rest/protected/self-service/flow
GET /auth/rest/protected/self-service/flows
DELETE /auth/rest/public/authentication
POST /auth/rest/public/authentication/applications/{param}/access
POST /auth/rest/public/authentication/default-application/access
DELETE /auth/rest/public/authentication/flow
POST /auth/rest/public/authentication/goto-targets/{param}/goto
POST /auth/rest/public/authentication/kerberos/not-possible
POST /auth/rest/public/authentication/location/access
POST /auth/rest/public/authentication/location/interpret
POST /auth/rest/public/authentication/oauth2/client/authorization/uri/retrieve
POST /auth/rest/public/authentication/password/check
GET /auth/rest/public/authentication/ui/configuration/access
GET /auth/rest/public/authentication/ui/configuration/logout
GET /auth/rest/public/authentication/ui/default/application/id
GET /auth/rest/public/authentication/ui/non-flow/configuration
GET /auth/rest/public/flow
GET /auth/rest/public/maintenance-messages
DELETE /auth/rest/public/self-service/flow
POST /auth/rest/public/self-service/flows/{param}/select
POST /auth/rest/public/self-service/goto-targets/{param}/goto
GET /auth/rest/public/ui/static/configuration
DELETE /auth/rest/public/user-self-registration/flow
POST /auth/rest/public/user-self-registration/flows/{param}/select
POST /auth/rest/public/user-self-registration/goto-targets/{param}/goto
GET /auth/rest/public/user-self-registration/ui/default/flow/id
POST /auth/rest/public/{param}/terms-of-services/accept-retrieved
POST /auth/rest/public/{param}/terms-of-services/deny-retrieved
POST /auth/rest/public/{param}/terms-of-services/retrieve

# Additional source route templates (method obscured by wrapper composition)
/auth/rest/protected/self-service
/auth/rest/protected/self-service/approval/airlock-2fa/offline
/auth/rest/protected/self-service/approval/airlock-2fa/status/poll
/auth/rest/public/authentication/airlock-2fa/offline
/auth/rest/public/authentication/airlock-2fa/status/poll
/auth/rest/public/authentication/fido/assertion-response/check
/auth/rest/public/authentication/fido/failure/report
/auth/rest/public/authentication/oauth2/client/authorization/check
/auth/rest/public/authentication/ui/on-failure
/auth/rest/public/self-service
/auth/rest/public/self-service/approval/airlock-2fa/offline
/auth/rest/public/self-service/approval/airlock-2fa/status/poll
/auth/rest/public/self-service/ui/on-failure
/auth/rest/public/self-service/user/identify
/auth/rest/public/ui/languages
/auth/rest/public/user-self-registration
/auth/rest/public/user-self-registration/airlock-2fa/activation/status/poll
/auth/rest/public/user-self-registration/message/acknowledge
/auth/rest/public/user-self-registration/oath/activation/complete
/auth/rest/public/user-self-registration/selection/options
/auth/rest/public/user-self-registration/selection/options/retrieve
/auth/rest/public/user-self-registration/ui/on-completed
/auth/rest/public/user-self-registration/ui/on-failure
/auth/rest/public/user-self-registration/verification/email/otp/check
/auth/rest/public/user-self-registration/verification/phone-number/otp/check
/auth/rest/public/user-self-registration/verification/phone-number/otp/resend

# Directly observed behavior on mein-portal-registrierung.baloise.de
GET /auth/rest/public/authentication/ui/non-flow/configuration -> 400 without required flow context
GET /auth/rest/public/authentication/ui/configuration/logout -> 400 without required logout query/context
POST /auth/rest/public/authentication/oauth2/client/authorization/uri/retrieve -> 400 UNEXPECTED_CALL in the default PASSWORD_REQUIRED step
POST /auth/rest/public/authentication/kerberos/not-possible -> 400 UNEXPECTED_CALL in the default PASSWORD_REQUIRED step
POST /auth/rest/public/authentication/password/check with empty JSON -> 400 VALIDATION_FAILED for required username/password fields
POST requests without the matching CSRFT759 cookie/header pair -> 303 /auth/rest/public/invalid/csrf-token

# Existing captured behavior includes password-reset-init selection, self-service user identification, disabled registration-flow selectors and CSRF-gated protected self-service routes.

# Additional method recovery from complete Angular bundles (2026-11-09)
# The generic Airlock 2FA poll service uses HttpClient POST with `queryOnly=true|false`.
POST /auth/rest/protected/self-service/approval/airlock-2fa/status/poll
POST /auth/rest/public/authentication/airlock-2fa/status/poll
POST /auth/rest/public/self-service/approval/airlock-2fa/status/poll
POST /auth/rest/public/user-self-registration/airlock-2fa/activation/status/poll

# OAuth client authorization checking serializes the current query string and POSTs it.
POST /auth/rest/public/authentication/oauth2/client/authorization/check

# Failure/completion page resolvers use HttpClient GET and append the current flow ID.
GET /auth/rest/public/authentication/ui/on-failure/{flowId}
GET /auth/rest/public/self-service/ui/on-failure/{flowId}
GET /auth/rest/public/user-self-registration/ui/on-failure/{flowId}
GET /auth/rest/public/user-self-registration/ui/on-completed/{flowId}

The source inventory now has method recovery for 37 non-parameterized bindings and four parameterized UI resolver families; the remaining method-obscured templates are retained without guessed methods.

# Additional form-action method recovery from shared Angular services (2026-11-09)
POST /auth/rest/public/user-self-registration/message/acknowledge
POST /auth/rest/public/user-self-registration/verification/email/otp/check
POST /auth/rest/public/user-self-registration/verification/phone-number/otp/check
POST /auth/rest/public/user-self-registration/verification/phone-number/otp/resend
POST /auth/rest/public/user-self-registration/oath/activation/complete
POST /auth/rest/public/authentication/fido/assertion-response/check
POST /auth/rest/public/authentication/fido/failure/report
POST /auth/rest/public/self-service/user/identify

The shared acknowledgement service POSTs a null body. OTP/FIDO services serialize their form or assertion data as JSON; resend POSTs a null body. The username-identification method was already captured live and is now normalized into the method-binding section.

# Runtime method confirmation (2026-11-09)
POST /auth/rest/public/user-self-registration/selection/options/retrieve

A normal anonymous Airlock session with mirrored CSRF state receives HTTP 405 for GET and `Allow: POST,OPTIONS` for OPTIONS on this route. Evidence: GET 01a1c0b1-6bfb-7654-98c2-905ba8d16192; OPTIONS 01a1c0b1-96c3-71fd-af62-14f418de6f8d. The POST was not invoked because it is a registration-flow state operation.

# Generic product-route expansion verified on this tenant (2026-11-09)
# Product source: product/airlock-iam-web-ui/unversioned
# Evidence: recon/airlock-registration-product-route-expansion-v1.txt

# Exact public handlers confirmed by OPTIONS Allow: POST,OPTIONS.
POST /auth/rest/public/authentication/airlock-2fa/activation/device-edit/continue
POST /auth/rest/public/authentication/airlock-2fa/activation/device-edit/data
POST /auth/rest/public/authentication/airlock-2fa/activation/status/poll
POST /auth/rest/public/authentication/airlock-2fa/offline-qr-code/otp/check
POST /auth/rest/public/authentication/airlock-2fa/passcode/check
POST /auth/rest/public/authentication/cronto/activation/complete
POST /auth/rest/public/authentication/cronto/activation/start
POST /auth/rest/public/authentication/cronto/offline
POST /auth/rest/public/authentication/cronto/otp/check
POST /auth/rest/public/authentication/cronto/otp/poll
POST /auth/rest/public/authentication/cronto/push-devices/activation/continue
POST /auth/rest/public/authentication/cronto/push-devices/activation/never
POST /auth/rest/public/authentication/cronto/push-devices/activation/skip
POST /auth/rest/public/authentication/email/otp/check
POST /auth/rest/public/authentication/email/otp/resend
POST /auth/rest/public/authentication/email/verification/otp/check
POST /auth/rest/public/authentication/fido/credential/edit
POST /auth/rest/public/authentication/fido/credential/edit/continue
POST /auth/rest/public/authentication/fido/registration/attestation-response/check
POST /auth/rest/public/authentication/fido/registration/challenge/retrieve
POST /auth/rest/public/authentication/fido/registration/failure/report
POST /auth/rest/public/authentication/matrix/check
POST /auth/rest/public/authentication/message/acknowledge
POST /auth/rest/public/authentication/mtan/otp/check
POST /auth/rest/public/authentication/mtan/otp/resend
POST /auth/rest/public/authentication/mtan/registration/iak/check
POST /auth/rest/public/authentication/mtan/registration/otp/check
POST /auth/rest/public/authentication/mtan/registration/otp/resend
POST /auth/rest/public/authentication/oath/activation/complete
POST /auth/rest/public/authentication/oath/otp/check
POST /auth/rest/public/authentication/otp/check
POST /auth/rest/public/authentication/password/change
POST /auth/rest/public/authentication/selection/options/retrieve
POST /auth/rest/public/authentication/ssi/issuance/poll
POST /auth/rest/public/authentication/ssi/verification/poll
POST /auth/rest/public/authentication/user/identify
POST /auth/rest/public/authentication/vasco/otp/check
POST /auth/rest/public/self-service/approval/airlock-2fa/offline-qr-code/otp/check
POST /auth/rest/public/self-service/approval/cronto/offline
POST /auth/rest/public/self-service/approval/cronto/otp/check
POST /auth/rest/public/self-service/approval/cronto/otp/poll
POST /auth/rest/public/self-service/approval/fido/assertion-response/check
POST /auth/rest/public/self-service/approval/fido/failure/report
POST /auth/rest/public/self-service/approval/matrix/check
POST /auth/rest/public/self-service/approval/mtan/otp/check
POST /auth/rest/public/self-service/approval/mtan/otp/resend
POST /auth/rest/public/self-service/approval/vasco/otp/check
POST /auth/rest/public/self-service/message/acknowledge
POST /auth/rest/public/self-service/selection/options/retrieve
POST /auth/rest/public/self-service/ssi/verification/poll
POST /auth/rest/public/self-service/verification/email/otp/check
POST /auth/rest/public/self-service/verification/mtan/otp/check
POST /auth/rest/public/user-self-registration/default-flow/select
POST /auth/rest/public/user-self-registration/ssi/verification/poll

# Protected route boundaries confirmed by OPTIONS -> 401 before method dispatch.
PROTECTED /auth/rest/protected/self-service/airlock-2fa/activation/status/poll
PROTECTED /auth/rest/protected/self-service/airlock-2fa/device-edit/continue
PROTECTED /auth/rest/protected/self-service/airlock-2fa/device-edit/data
PROTECTED /auth/rest/protected/self-service/approval/airlock-2fa/offline-qr-code/otp/check
PROTECTED /auth/rest/protected/self-service/approval/cronto/offline
PROTECTED /auth/rest/protected/self-service/approval/cronto/otp/check
PROTECTED /auth/rest/protected/self-service/approval/cronto/otp/poll
PROTECTED /auth/rest/protected/self-service/approval/fido/assertion-response/check
PROTECTED /auth/rest/protected/self-service/approval/fido/failure/report
PROTECTED /auth/rest/protected/self-service/approval/matrix/check
PROTECTED /auth/rest/protected/self-service/approval/mtan/otp/check
PROTECTED /auth/rest/protected/self-service/approval/mtan/otp/resend
PROTECTED /auth/rest/protected/self-service/approval/vasco/otp/check
PROTECTED /auth/rest/protected/self-service/cronto/activation/complete
PROTECTED /auth/rest/protected/self-service/cronto/activation/start
PROTECTED /auth/rest/protected/self-service/cronto/device/edit
PROTECTED /auth/rest/protected/self-service/cronto/device/edit/continue
PROTECTED /auth/rest/protected/self-service/cronto/device/info/retrieve
PROTECTED /auth/rest/protected/self-service/cronto/push-devices/activation/continue
PROTECTED /auth/rest/protected/self-service/email/verification/otp/check
PROTECTED /auth/rest/protected/self-service/fido/credential/edit
PROTECTED /auth/rest/protected/self-service/fido/credential/edit/continue
PROTECTED /auth/rest/protected/self-service/fido/registration/attestation-response/check
PROTECTED /auth/rest/protected/self-service/fido/registration/challenge/retrieve
PROTECTED /auth/rest/protected/self-service/fido/registration/failure/report
PROTECTED /auth/rest/protected/self-service/message/acknowledge
PROTECTED /auth/rest/protected/self-service/mtan/registration/iak/check
PROTECTED /auth/rest/protected/self-service/mtan/registration/otp/check
PROTECTED /auth/rest/protected/self-service/mtan/registration/otp/resend
PROTECTED /auth/rest/protected/self-service/oath/activation/complete
PROTECTED /auth/rest/protected/self-service/password/change
PROTECTED /auth/rest/protected/self-service/selection/options/retrieve
PROTECTED /auth/rest/protected/self-service/ssi/issuance/poll

# 25 generic product candidates matching random-path 404 controls are intentionally excluded.
# The active tenant inventory now contains 142 route templates: the original 55 plus 87 newly confirmed handlers/boundaries.


# Complete product-source method and dynamic-route augmentation (2026-11-09)
# Source: product/airlock-iam-web-ui/unversioned (245 retained files).
# Evidence: recon/airlock-dynamic-management-route-expansion-v1.txt and recon/airlock-dynamic-route-parity-v1.txt

# The 33 action paths previously classified only as protected boundaries are POST handlers in the shared Angular component services:
POST /auth/rest/protected/self-service/airlock-2fa/activation/status/poll  # protected boundary
POST /auth/rest/protected/self-service/airlock-2fa/device-edit/continue  # protected boundary
POST /auth/rest/protected/self-service/airlock-2fa/device-edit/data  # protected boundary
POST /auth/rest/protected/self-service/approval/airlock-2fa/offline-qr-code/otp/check  # protected boundary
POST /auth/rest/protected/self-service/approval/cronto/offline  # protected boundary
POST /auth/rest/protected/self-service/approval/cronto/otp/check  # protected boundary
POST /auth/rest/protected/self-service/approval/cronto/otp/poll  # protected boundary
POST /auth/rest/protected/self-service/approval/fido/assertion-response/check  # protected boundary
POST /auth/rest/protected/self-service/approval/fido/failure/report  # protected boundary
POST /auth/rest/protected/self-service/approval/matrix/check  # protected boundary
POST /auth/rest/protected/self-service/approval/mtan/otp/check  # protected boundary
POST /auth/rest/protected/self-service/approval/mtan/otp/resend  # protected boundary
POST /auth/rest/protected/self-service/approval/vasco/otp/check  # protected boundary
POST /auth/rest/protected/self-service/cronto/activation/complete  # protected boundary
POST /auth/rest/protected/self-service/cronto/activation/start  # protected boundary
POST /auth/rest/protected/self-service/cronto/device/edit  # protected boundary
POST /auth/rest/protected/self-service/cronto/device/edit/continue  # protected boundary
POST /auth/rest/protected/self-service/cronto/device/info/retrieve  # protected boundary
POST /auth/rest/protected/self-service/cronto/push-devices/activation/continue  # protected boundary
POST /auth/rest/protected/self-service/email/verification/otp/check  # protected boundary
POST /auth/rest/protected/self-service/fido/credential/edit  # protected boundary
POST /auth/rest/protected/self-service/fido/credential/edit/continue  # protected boundary
POST /auth/rest/protected/self-service/fido/registration/attestation-response/check  # protected boundary
POST /auth/rest/protected/self-service/fido/registration/challenge/retrieve  # protected boundary
POST /auth/rest/protected/self-service/fido/registration/failure/report  # protected boundary
POST /auth/rest/protected/self-service/message/acknowledge  # protected boundary
POST /auth/rest/protected/self-service/mtan/registration/iak/check  # protected boundary
POST /auth/rest/protected/self-service/mtan/registration/otp/check  # protected boundary
POST /auth/rest/protected/self-service/mtan/registration/otp/resend  # protected boundary
POST /auth/rest/protected/self-service/oath/activation/complete  # protected boundary
POST /auth/rest/protected/self-service/password/change  # protected boundary
POST /auth/rest/protected/self-service/selection/options/retrieve  # protected boundary
POST /auth/rest/protected/self-service/ssi/issuance/poll  # protected boundary

# Segment-array HttpClient analysis found 61 additional active route templates:
POST /auth/rest/oauth2/authorization-servers/{param}/check-origin
GET /auth/rest/protected/self-service/account-link/providers
POST /auth/rest/protected/self-service/account-link/providers/{param}/link
GET /auth/rest/protected/self-service/account-links
POST /auth/rest/protected/self-service/account-links/{param}/remove
GET /auth/rest/protected/self-service/airlock-2fa/app-devices
POST /auth/rest/protected/self-service/airlock-2fa/devices/{param}/remove
POST /auth/rest/protected/self-service/airlock-2fa/devices/{param}/select
GET /auth/rest/protected/self-service/airlock-2fa/hardware-devices
GET /auth/rest/protected/self-service/cronto/devices
POST /auth/rest/protected/self-service/cronto/devices/{param}/select
POST /auth/rest/protected/self-service/cronto/devices/{param}/remove
POST /auth/rest/protected/self-service/cronto/devices/{param}/disable
POST /auth/rest/protected/self-service/cronto/devices/{param}/enable
POST /auth/rest/protected/self-service/cronto/devices/{param}/push/enable
POST /auth/rest/protected/self-service/cronto/devices/{param}/push/disable
GET /auth/rest/protected/self-service/device-token/tokens
GET /auth/rest/protected/self-service/fido/credentials
POST /auth/rest/protected/self-service/fido/credentials/{param}/select
POST /auth/rest/protected/self-service/fido/credentials/{param}/remove
POST /auth/rest/protected/self-service/fido/credentials/{param}/disable
POST /auth/rest/protected/self-service/fido/credentials/{param}/enable
POST /auth/rest/protected/self-service/flows/{param}/select
POST /auth/rest/protected/self-service/goto-targets/{param}/goto
GET /auth/rest/protected/self-service/mtan/tokens
POST /auth/rest/protected/self-service/mtan/tokens/{param}/select
POST /auth/rest/protected/self-service/mtan/tokens/{param}/remove
POST /auth/rest/protected/self-service/oauth2/authorization-servers/{param}/clients/{param}/consents/remove
GET /auth/rest/protected/self-service/oauth2/consents
POST /auth/rest/protected/self-service/oauth2/consents/{param}/deny
POST /auth/rest/protected/self-service/oauth2/consents/{param}/grant
GET /auth/rest/protected/self-service/oauth2/sessions
POST /auth/rest/protected/self-service/oauth2/sessions/{param}/remove
GET /auth/rest/protected/self-service/remember-me/devices
POST /auth/rest/protected/self-service/remember-me/devices/{param}/remove
POST /auth/rest/protected/self-service/representation/start
GET /auth/rest/protected/self-service/ui/configuration/account-links
GET /auth/rest/protected/self-service/ui/configuration/oauth2/consents
GET /auth/rest/protected/self-service/ui/configuration/oauth2/sessions
GET /auth/rest/protected/self-service/ui/configuration/portal
GET /auth/rest/protected/self-service/ui/configuration/remember-me/devices
GET /auth/rest/protected/self-service/ui/configuration/representation
GET /auth/rest/protected/self-service/ui/configuration/tokens/airlock-2fa
GET /auth/rest/protected/self-service/ui/configuration/tokens/cronto
GET /auth/rest/protected/self-service/ui/configuration/tokens/device-token
GET /auth/rest/protected/self-service/ui/configuration/tokens/fido
GET /auth/rest/protected/self-service/ui/configuration/tokens/mtan
POST /auth/rest/protected/self-service/vasco/devices/{param}/activate
POST /auth/rest/public/authentication/migration/options/{param}/select
POST /auth/rest/public/authentication/migration/options/reject
POST /auth/rest/public/authentication/migration/options/skip
POST /auth/rest/public/authentication/oauth2/authorization-server/consent/local/deny
POST /auth/rest/public/authentication/oauth2/authorization-server/consent/local/grant
POST /auth/rest/public/authentication/oauth2/authorization-server/consent/local/retrieve
POST /auth/rest/public/authentication/oauth2/authorization-server/consent/remote/check
POST /auth/rest/public/authentication/password-only/check
POST /auth/rest/public/authentication/secret-questions/provision
GET /auth/rest/public/authentication/ui/configuration/oauth2/authorization-servers/{param}/session-management
POST /auth/rest/public/self-service/password/set
POST /auth/rest/public/self-service/verification/secret-questions/answer
GET /auth/rest/public/ui/languages

The normalized active Airlock IAM client inventory now contains 203 route templates. The 47 new protected management paths return 401 before dispatch; 13 public routes expose source-matching Allow headers; the OAuth origin-check route is POST-only and distinguishes from a same-prefix random 404 control with GET 405. No state-changing operation was invoked.


# Production complete-graph dynamic-step augmentation (2026-11-09)
# Evidence: recon/airlock-dynamic-step-routes-v1.txt

POST /auth/rest/public/authentication/dynamic-steps/{stepId}/activate
POST /auth/rest/public/authentication/dynamic-steps/{stepId}/deactivate
POST /auth/rest/protected/self-service/dynamic-steps/{stepId}/activate
POST /auth/rest/protected/self-service/dynamic-steps/{stepId}/deactivate
POST /auth/rest/public/self-service/dynamic-steps/{stepId}/activate
POST /auth/rest/public/self-service/dynamic-steps/{stepId}/deactivate
POST /auth/rest/public/user-self-registration/dynamic-steps/{stepId}/activate
POST /auth/rest/public/user-self-registration/dynamic-steps/{stepId}/deactivate

The normalized active Airlock IAM REST inventory now contains 211 route templates. The complete 180-chunk production graph also defines 214 Angular client routes documented separately in `recon/airlock-angular-ui-route-graph-v1.txt`.

# Captured server-only technical client registration (2026-11-10)
# Evidence: recon/airlock-tech-client-registration-contracts-v1.txt
POST /auth/rest/public/tech-client-registration/oauth2/{authorizationServerId}/register

The normalized active Airlock IAM REST inventory now contains 222 route templates and 223 method/path bindings.

# Captured server-only user-self-registration data route (2026-11-10)
# Evidence: recon/airlock-registration-data-route-v1.txt
POST /auth/rest/public/user-self-registration/registration/data

The normalized active Airlock IAM REST inventory now contains 223 route templates and 224 method/path bindings.

# Jersey WADL-disclosed server-only routes (2026-11-10)
# Evidence: recon/airlock-public-wadl-contracts-v1.txt
GET /auth/rest/public/application.wadl
GET /auth/rest/public/application.wadl/{externalGrammarPath}
POST /auth/rest/public/baloise/saml2/transform

The normalized active Airlock IAM REST inventory now contains 226 route templates and 227 method/path bindings.

# OpenAPI/captured server-only authentication data edit route (2026-11-10)
# Evidence: recon/airlock-authentication-data-edit-route-v1.txt
POST /auth/rest/public/authentication/data/edit

The normalized active Airlock IAM REST inventory now contains 227 route templates and 228 method/path bindings.

# Version-stable Loginapp OpenAPI server route expansion (2026-11-10)
# Evidence: recon/airlock-loginapp-openapi-route-expansion-v1.txt
DELETE /auth/rest/oauth2/authorization-servers/{param}/sessions
DELETE /auth/rest/oauth2/authorization-servers/{param}/sessions/{param}
DELETE /auth/rest/protected/my/tokens/cronto/devices/{param}
DELETE /auth/rest/protected/my/tokens/cronto/devices/{param}/enable
DELETE /auth/rest/protected/my/tokens/cronto/devices/{param}/push/allow
DELETE /auth/rest/protected/my/tokens/device-tokens/{param}
DELETE /auth/rest/public/authentication/
GET /auth/rest/oauth2/authorization-servers/{param}/.well-known/oauth-authorization-server
GET /auth/rest/oauth2/authorization-servers/{param}/.well-known/openid-configuration
GET /auth/rest/oauth2/authorization-servers/{param}/jwks
GET /auth/rest/oauth2/authorization-servers/{param}/resources/{param}
GET /auth/rest/oauth2/authorization-servers/{param}/session
GET /auth/rest/oauth2/authorization-servers/{param}/sessions
GET /auth/rest/oauth2/authorization-servers/{param}/userinfo
GET /auth/rest/protected/my/self
GET /auth/rest/protected/my/tokens/cronto/devices
GET /auth/rest/protected/my/tokens/cronto/devices/{param}
GET /auth/rest/protected/my/tokens/device-tokens
GET /auth/rest/protected/my/tokens/mtan
GET /auth/rest/protected/secret-questions
GET /auth/rest/protected/self-service/ui/on-completed/{param}
GET /auth/rest/protected/self-service/ui/on-failure/{param}
GET /auth/rest/public/authentication/
GET /auth/rest/public/self-service/ui/on-completed/{param}
PATCH /auth/rest/oauth2/authorization-servers/{param}/session/custom-attributes
PATCH /auth/rest/protected/my/tokens/cronto/devices/{param}
PATCH /auth/rest/protected/my/tokens/mtan/{param}
POST /auth/rest/oauth2/authorization-servers/{param}/introspect
POST /auth/rest/oauth2/authorization-servers/{param}/par
POST /auth/rest/oauth2/authorization-servers/{param}/resources/{param}
POST /auth/rest/oauth2/authorization-servers/{param}/revoke
POST /auth/rest/oauth2/authorization-servers/{param}/token
POST /auth/rest/oauth2/authorization-servers/{param}/userinfo
POST /auth/rest/protected/my/password/change
POST /auth/rest/protected/my/secret-questions/{param}/answer
POST /auth/rest/protected/my/tokens/cronto/activation-letters/order
POST /auth/rest/protected/my/tokens/cronto/devices/activation/complete
POST /auth/rest/protected/my/tokens/cronto/devices/activation/start
POST /auth/rest/protected/my/tokens/cronto/devices/{param}/enable
POST /auth/rest/protected/my/tokens/cronto/devices/{param}/push/allow
POST /auth/rest/protected/my/tokens/device-tokens
POST /auth/rest/protected/my/tokens/mtan/{param}/start-number-change
POST /auth/rest/protected/my/tokens/mtan/{param}/verify-number-change
POST /auth/rest/protected/self-service/airlock-2fa/activation/challenge/retrieve
POST /auth/rest/protected/self-service/airlock-2fa/activation/start
POST /auth/rest/protected/self-service/airlock-2fa/device-edit/data/retrieve
POST /auth/rest/protected/self-service/airlock-2fa/recovery/start
POST /auth/rest/protected/self-service/airlock-2fa/recovery/status/poll
POST /auth/rest/protected/self-service/approval/airlock-2fa/devices/retrieve
POST /auth/rest/protected/self-service/approval/airlock-2fa/devices/{param}/select
POST /auth/rest/protected/self-service/approval/airlock-2fa/mobile-only/challenge/retrieve
POST /auth/rest/protected/self-service/approval/airlock-2fa/offline-qr-code/challenge/retrieve
POST /auth/rest/protected/self-service/approval/cronto/challenge/retrieve
POST /auth/rest/protected/self-service/approval/cronto/push-devices/retrieve
POST /auth/rest/protected/self-service/approval/cronto/push-devices/{param}/select
POST /auth/rest/protected/self-service/approval/fido/challenge/retrieve
POST /auth/rest/protected/self-service/approval/matrix/challenge/retrieve
POST /auth/rest/protected/self-service/approval/mtan/otp/resend-info/retrieve
POST /auth/rest/protected/self-service/approval/mtan/tokens/retrieve
POST /auth/rest/protected/self-service/approval/mtan/tokens/{param}/select
POST /auth/rest/protected/self-service/cronto/activation/challenge/retrieve
POST /auth/rest/protected/self-service/cronto/activation/start-challenge/retrieve
POST /auth/rest/protected/self-service/cronto/push-devices/activation/challenge/retrieve
POST /auth/rest/protected/self-service/data/continue
POST /auth/rest/protected/self-service/data/edit
POST /auth/rest/protected/self-service/data/info/retrieve
POST /auth/rest/protected/self-service/data/validate
POST /auth/rest/protected/self-service/device-token/registration/start
POST /auth/rest/protected/self-service/fido/credential/info/retrieve
POST /auth/rest/protected/self-service/mtan/registration/otp/resend-info/retrieve
POST /auth/rest/protected/self-service/mtan/registration/start
POST /auth/rest/protected/self-service/mtan/token/edit
POST /auth/rest/protected/self-service/mtan/token/edit/continue
POST /auth/rest/protected/self-service/mtan/token/info/retrieve
POST /auth/rest/protected/self-service/oauth2/client/authorization/check
POST /auth/rest/protected/self-service/oauth2/client/authorization/uri/retrieve
POST /auth/rest/protected/self-service/selection/options/{param}/select
POST /auth/rest/public/authentication/airlock-2fa/activation/challenge/retrieve
POST /auth/rest/public/authentication/airlock-2fa/activation/device-edit/data/retrieve
POST /auth/rest/public/authentication/airlock-2fa/activation/start
POST /auth/rest/public/authentication/airlock-2fa/devices/retrieve
POST /auth/rest/public/authentication/airlock-2fa/devices/{param}/select
POST /auth/rest/public/authentication/airlock-2fa/mobile-only/challenge/retrieve
POST /auth/rest/public/authentication/airlock-2fa/offline-qr-code/challenge/retrieve
POST /auth/rest/public/authentication/airlock-2fa/recovery/start
POST /auth/rest/public/authentication/airlock-2fa/recovery/status/poll
POST /auth/rest/public/authentication/airlock-2fa/zero-touch-info/retrieve
POST /auth/rest/public/authentication/cronto/activation/challenge/retrieve
POST /auth/rest/public/authentication/cronto/activation/start-challenge/retrieve
POST /auth/rest/public/authentication/cronto/challenge/retrieve
POST /auth/rest/public/authentication/cronto/push-devices/activation/challenge/retrieve
POST /auth/rest/public/authentication/cronto/push-devices/retrieve
POST /auth/rest/public/authentication/cronto/push-devices/{param}/select
POST /auth/rest/public/authentication/data/continue
POST /auth/rest/public/authentication/data/info/retrieve
POST /auth/rest/public/authentication/data/validate
POST /auth/rest/public/authentication/device-token/{param}/challenge/retrieve
POST /auth/rest/public/authentication/fido/challenge/retrieve
POST /auth/rest/public/authentication/matrix/challenge/retrieve
POST /auth/rest/public/authentication/migration/options/retrieve
POST /auth/rest/public/authentication/mtan/otp/resend-info/retrieve
POST /auth/rest/public/authentication/mtan/registration/info/retrieve
POST /auth/rest/public/authentication/mtan/registration/otp/resend-info/retrieve
POST /auth/rest/public/authentication/mtan/registration/start
POST /auth/rest/public/authentication/mtan/tokens/retrieve
POST /auth/rest/public/authentication/mtan/tokens/{param}/select
POST /auth/rest/public/authentication/password/set
POST /auth/rest/public/authentication/secret-questions/status/retrieve
POST /auth/rest/public/authentication/selection/options/{param}/select
POST /auth/rest/public/authentication/terms-of-services/accept-retrieved
POST /auth/rest/public/authentication/terms-of-services/deny-retrieved
POST /auth/rest/public/authentication/terms-of-services/retrieve
POST /auth/rest/public/authentication/username/identify
POST /auth/rest/public/self-service/approval/airlock-2fa/devices/retrieve
POST /auth/rest/public/self-service/approval/airlock-2fa/devices/{param}/select
POST /auth/rest/public/self-service/approval/airlock-2fa/mobile-only/challenge/retrieve
POST /auth/rest/public/self-service/approval/airlock-2fa/offline-qr-code/challenge/retrieve
POST /auth/rest/public/self-service/approval/cronto/challenge/retrieve
POST /auth/rest/public/self-service/approval/cronto/push-devices/retrieve
POST /auth/rest/public/self-service/approval/cronto/push-devices/{param}/select
POST /auth/rest/public/self-service/approval/fido/challenge/retrieve
POST /auth/rest/public/self-service/approval/matrix/challenge/retrieve
POST /auth/rest/public/self-service/approval/mtan/otp/resend-info/retrieve
POST /auth/rest/public/self-service/approval/mtan/tokens/retrieve
POST /auth/rest/public/self-service/approval/mtan/tokens/{param}/select
POST /auth/rest/public/self-service/device-token/check
POST /auth/rest/public/self-service/device-token/{param}/challenge/retrieve
POST /auth/rest/public/self-service/selection/options/{param}/select
POST /auth/rest/public/self-service/username/identify
POST /auth/rest/public/self-service/verification/secret-questions/retrieve
POST /auth/rest/public/tech-client-registration/dynamic-steps/retrieve
POST /auth/rest/public/tech-client-registration/dynamic-steps/{param}/activate
POST /auth/rest/public/tech-client-registration/dynamic-steps/{param}/deactivate
POST /auth/rest/public/tech-client-registration/goto-targets/retrieve
POST /auth/rest/public/tech-client-registration/goto-targets/{param}/goto
POST /auth/rest/public/user-self-registration/airlock-2fa/activation/challenge/retrieve
POST /auth/rest/public/user-self-registration/registration/continue
POST /auth/rest/public/user-self-registration/registration/info/retrieve
POST /auth/rest/public/user-self-registration/registration/validate
POST /auth/rest/public/user-self-registration/selection/options/{param}/select
POST /auth/rest/public/user-self-registration/terms-of-services/accept-retrieved
POST /auth/rest/public/user-self-registration/terms-of-services/deny-retrieved
POST /auth/rest/public/user-self-registration/terms-of-services/retrieve

The normalized active/source-defined Airlock IAM REST inventory now contains 361 route templates and 371 method/path bindings.

# OAuth2 Jersey WADL handlers (2026-11-10)
# Evidence: recon/airlock-oauth-wadl-contracts-v1.txt
GET /auth/rest/oauth2/application.wadl
GET /auth/rest/oauth2/application.wadl/{externalGrammarPath}

The normalized active/source-defined Airlock IAM REST inventory now contains 363 route templates and 373 method/path bindings.

# Target-generated application WADL expansion (2026-11-10)
# Evidence: recon/airlock-application-wadl-route-expansion-v1.txt
GET /auth/rest/public/authentication/application.wadl
GET /auth/rest/public/authentication/application.wadl/{param}
GET /auth/rest/public/self-service/application.wadl
GET /auth/rest/public/self-service/application.wadl/{param}
GET /auth/rest/public/user-self-registration/application.wadl
GET /auth/rest/public/user-self-registration/application.wadl/{param}
GET /auth/rest/public/tech-client-registration/application.wadl
GET /auth/rest/public/tech-client-registration/application.wadl/{param}
GET /auth/rest/protected/application.wadl
GET /auth/rest/protected/application.wadl/{param}
POST /auth/rest/public/authentication/cronto/offline/
POST /auth/rest/public/authentication/ssi/invitation/poll
POST /auth/rest/public/self-service/approval/airlock-2fa/mobile-only/challenge/retrieve/
POST /auth/rest/public/self-service/approval/airlock-2fa/offline/
POST /auth/rest/public/self-service/approval/cronto/offline/
POST /auth/rest/public/self-service/ssi/invitation/poll
POST /auth/rest/public/user-self-registration/ssi/invitation/poll

The normalized active/source-defined Airlock IAM REST inventory now contains 380 route templates and 390 method/path bindings.