Public paths
These paths skip the token check. They are listed in quarkus.http.auth.permission.public.paths in each service's application.yml, so the list can be reviewed in version control.
LMS service
| Path | Why it is public | What protects it |
|---|---|---|
/api/v1/lms/certificates/verify/* | A person with no account checks a certificate. | The key is the certificate's identifier, a random UUID. A certificate number does not resolve. |
/api/v1/lms/certificates/*/pdf and /qr | Opened as a link or image from a certificate. | The same unguessable certificate identifier. |
/api/v1/lms/lessons/*/stream | A <video> element cannot send an Authorization header. | A signed, expiring stream token scoped to one lesson and minted only for an enrolled learner. |
/api/v1/lms/recordings/*/stream | Same reason. | The same token, scoped to one recording. |
/api/v1/lms/live-classes/egress-webhook | Server-to-server callback from LiveKit. | A LiveKit-signed JWT with a SHA-256 body checksum, verified in constant time. |
The wildcard * matches a single path segment in Quarkus 3.15. A test harness in libs/common-models checks that a sibling such as /certificates/my-certificates stays authenticated.
Onboarding service
| Path | Why it is public | What protects it |
|---|---|---|
POST /api/v1/onboarding/register | The onboarding wizard runs before the founder has a token. | Decided as public. The write is a registration. |
GET /api/v1/onboarding/programs | The wizard lists programmes. | Read of programme names. |
POST /api/v1/onboarding/trl-assessment and /enroll | The wizard reaches them before a token exists. | Confined in OnboardingResource to a venture that has not finished the wizard. |
The instant-value endpoint was removed from this list on purpose. It now needs a token.
Every service
| Path | Why it is public | What protects it |
|---|---|---|
/q/health, /q/health/*, /q/metrics | The kubelet probes them with no credential. | The ingress does not route /q, so they are reachable only inside the cluster. |
On the frontend
| Path | Why it is public | What protects it |
|---|---|---|
GET /status and GET /api/status | A public status page. | The response holds only component names, states and timestamps. |
POST /api/auth/token | It is how a person signs in. | A persona allow-list and the identity provider's own credential check. |
POST /api/auth/refresh and /logout | They act on the caller's own session cookie. | The cookie is HttpOnly and scoped to /api/auth. |
The generated API reference marks each public operation with its own scheme or with no credential. See the LMS and Onboarding references.
Sources: services/*/src/main/resources/application.yml, openapi/overlays/{lms,onboarding}.yaml, frontend/src/app/api/**.