API surface and route ledger
Know which routes are public automation contracts.
Shiplet's OpenAPI document is the public automation contract. Its method, path, authentication, scopes, schemas, and Code Mode marker are supported together.
Browser-only pages, trusted frame protocols, and operator-internal recovery routes stay outside OpenAPI because they depend on cookies, redirects, top-level confirmation, origin-bound messages, or operational authority.
Choose the supported surface
- Use OpenAPI operations for REST and Code Mode automation.
- Use browser OAuth for interactive MCP.
- Use the first-party browser flow for review, account settings, and protected confirmation.
The executable route ledger requires every registered route to appear in OpenAPI or match exactly one narrow exclusion family. Missing and duplicate classifications fail the documentation gate.
Verification
api-route-ledger.json classifies routes outside OpenAPI. The check resolves local and relative-imported string constants; a dynamic or unresolvable registration fails the gate.
Next: read API keys or Code Mode MCP.