> ## Documentation Index
> Fetch the complete documentation index at: https://secdocs.asikoexpress.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Internal & Non-Exposed Endpoints

> Routes that exist in the codebase but are not reachable through the public gateway

This page exists so that every route in the codebase is accounted for somewhere in this
documentation, even the ones you can't call as an API consumer. It is not a reference for
integrators — nothing here is reachable through `https://asikodevapi.candourit.io`.

## `/v1/internal/*` — service-to-service only

user-service exposes three controllers under `internal/*`, marked `@ApiExcludeController()` so
they never appear in Swagger either. **api-gateway's proxy has no route prefix for `/v1/internal`**
— there is no way to reach these from outside the private network. They exist purely so
**admin-service** can call user-service directly (over the internal Docker network) when handling
requests made to the public `/v1/admin/*` endpoints in the **Admin** reference group.

| Route                                                      | Purpose                                               |
| ---------------------------------------------------------- | ----------------------------------------------------- |
| `POST /v1/internal/trade-accounts/:userId/approve`         | Backs `POST /v1/admin/trade-accounts/:userId/approve` |
| `GET /v1/internal/users`                                   | Backs `GET /v1/admin/users`                           |
| `GET /v1/internal/users/:id`                               | Backs `GET /v1/admin/users/:id`                       |
| `POST /v1/internal/users/:id/roles/:role`                  | Backs role-grant under `/v1/admin/users`              |
| `DELETE /v1/internal/users/:id/roles/:role`                | Backs role-revoke under `/v1/admin/users`             |
| `POST /v1/internal/users/:id/suspend`                      | Backs `POST /v1/admin/users/:id/suspend`              |
| `POST /v1/internal/users/:id/reactivate`                   | Backs `POST /v1/admin/users/:id/reactivate`           |
| `POST /v1/internal/users/:id/deactivate`                   | Backs `POST /v1/admin/users/:id/deactivate`           |
| `GET /v1/internal/wholesale-applications`                  | Backs `GET /v1/admin/wholesale-applications`          |
| `POST /v1/internal/wholesale-applications/:userId/approve` | Backs the admin approval endpoint                     |
| `POST /v1/internal/wholesale-applications/:userId/reject`  | Backs the admin rejection endpoint                    |

If you need one of these capabilities as an API consumer, use the corresponding `/v1/admin/*`
endpoint in the **Admin** reference group — it requires `ADMIN`/`SUPER_ADMIN` and forwards to the
matching internal route for you.

## Per-service health checks

Every backend service exposes its own `GET /v1/health` for container orchestration (Docker
Swarm) to poll directly — **api-gateway does not proxy any of these**, since health checks are
meant to hit each container's own port, not go through the gateway. The only health check
reachable as an API consumer is the gateway's own:

```
GET https://asikodevapi.candourit.io/v1/health
```

which reports the gateway's own status, not the health of the six backend services behind it.

## Gateway-only dev utility

`GET /v1/services/routes` on api-gateway returns the internal path-prefix → service routing table
used by the proxy (the same table summarized in the [Introduction](/introduction)). It responds
with `501`-style `{"message": "Not available in production"}` whenever `NODE_ENV=production`, so
it's a local-development convenience, not part of the supported API.