kra-oa/docs/audit/local-api-inventory.md

Local Administration API Inventory

Scope and method

This is the local baseline for the GVA parity audit. It inventories every route registered by internal/server/gin.go, excluding no local route from the inventory. The current route-contract test asserts 178 registered Gin routes, including GET /health and the Swagger wildcard. A configured routerPrefix is prepended to every path below at runtime. Local-file downloads are handled by the NoRoute -> serveLocalStorage fallback, so their GET/HEAD URL is functional but intentionally does not appear in this registered-route count, engine.Routes(), or /api/syncApi input. The local dynamic Swagger is likewise built only from registered routes; the baseline GVA's pre-generated Swagger also omits the static wildcard. The GVA reference does register that wildcard in Routes(), so the count is not proof that the two route tables are identical; see parity-crosscut.md.

Source of truth:

• registration: internal/server/router/*.go and internal/server/gin.go;
• handler-to-service calls: internal/server/handler/*.go;
• dependency assembly: cmd/kratos-admin/wire_gen.go;
• frontend comparison: web/src/api/**/*.js, web/src/modules/**/api/*.js, and the direct SSE use in web/src/view/systemTools/timedTask/useAlertStream.js.

Unless marked public, routes are behind JWT authentication, forced-password change protection, Casbin/data-scope access control, and the normal error/audit middleware. OK means the standard JSON success envelope; Page<T> means { list, total, page, pageSize }. Download and SSE rows state their special wire result. The Call column gives the exact handler and service entrypoint; the module pipeline directly below it completes the service/biz/data chain.

FE means a matching frontend request exists. FE-direct means the browser calls it directly rather than via an api/*.js function. -- is a registered backend route without a current frontend call site.

Architecture map

Local area	Handler service	Biz usecase	Repository/data implementation
API, Casbin	APIService	APIUsecase	APIRepo -> data.apiRepo
User/navigation	UserService, AuthService, TokenService	UserUsecase, AuthenticationUsecase, TokenUsecase	UserRepo, APITokenRepo -> data.userRepo, data.apiTokenRepo
Authority	AuthorityService, PermissionService	AuthorityUsecase, PermissionUsecase	AuthorityAccessRepo, PermissionRepo -> data.authorityAccessRepo, data.permissionRepo
Menu	MenuService	MenuUsecase	MenuRepo -> data.menuRepo
Organisation	DepartmentService, PositionService	DepartmentUsecase, PositionUsecase	DepartmentRepo, PositionRepo -> data.departmentRepo, data.positionRepo
Dictionary	DictionaryService	DictionaryUsecase	DictionaryRepo -> data.dictionaryRepo
Parameters	ParameterService	ParameterUsecase	ParameterRepo -> data.parameterRepo
Runtime/system/security	SystemConfigService, SecurityService	SystemConfigUsecase, SecurityUsecase	InitializationRepo, SecurityRepo -> data.initializationRepo, data.securityRepo; runtime settings/config store
Audit/logs/errors	AuditService, LogViewerService	AuditUsecase, LogViewerUsecase	AuditQueryRepo, LogFileRepo -> data.auditRepo, data.logFileRepo
Export/version	ExportService, VersionService	ExportUsecase, VersionUsecase	ExportRepo, VersionRepo -> data.exportRepo, data.versionRepo; export token cache
Tasks	TaskService	TaskApplicationUsecase -> TaskUsecase	TaskRepo -> data.taskRepo; worker scheduler/runtime
Media	MediaService	MediaUsecase	MediaRepo -> data.mediaRepo; FileStorage, upload sessions
Announcement/email	AnnouncementService, EmailService	AnnouncementUsecase, EmailUsecase	AnnouncementRepo -> data.announcementRepo; EmailRepo -> data.NewEmailRepo(runtime)

1. Bootstrap and public endpoints

Method/path	Visibility	Call	Key input -> output	Primary effect	FE
GET /health	public	inline Gin handler	none -> "ok"	liveness only	--
GET /swagger/*any	public	registerSwagger	Swagger UI/document -> HTML/JSON	generated from registered Gin routes	--
POST /base/captcha	public	Public.Captcha -> SecurityService.Captcha	captcha config -> captcha payload	cache-backed captcha creation when enabled	FE
POST /base/login	public	Public.Login -> AuthService.Login -> AuthenticationUsecase -> User/Security/Audit repos	LoginRequest -> token/user result	authenticate, issue token, write login audit; apply lockout policy	FE
POST /init/checkdb	public	Public.CheckDatabase -> SystemConfigService.IsInitialized -> SystemConfigUsecase -> InitializationRepo	none -> initialization status	read DB/init state	FE
POST /init/initdb	public	Public.InitializeDatabase -> SystemConfigService.InitializeRoutes -> SystemConfigUsecase -> InitializationRepo	dto.DatabaseInitRequest + current routes -> OK	initialize schema/seed data and register current routes	FE

2. API registry and Casbin policy

Pipeline: API handler -> APIService -> APIUsecase -> APIRepo -> data.apiRepo. The Casbin endpoints share that pipeline because policy-path associations are stored and queried through the API repository.

Method/path	Call	Key input -> output	Primary effect	FE
POST /api/getApiList	API.List -> ListAPI	APIListRequest(page,pageSize,filters) -> Page<API>	read	FE
POST /api/getAllApis	API.All -> AllAPI	optional body ignored -> {apis}	read non-paginated, strict filtering	FE
POST /api/createApi	API.Create -> CreateAPIRequest	APIRequest(path,method,group,description) -> {api}	create API registry row	FE
POST /api/updateApi	API.Update -> UpdateAPIRequest	APIRequest -> OK	update registry row	FE
POST /api/deleteApi	API.Delete -> DeleteAPI	{id} -> OK	delete one API and policy association as repo defines	FE
DELETE /api/deleteApisByIds	API.DeleteByIDs -> DeleteAPIs	{ids} -> OK	batch delete APIs	FE
POST /api/getApiById	API.Find -> FindAPIResponse	{id} -> {api}	read	FE
GET /api/getApiGroups	API.Groups -> Groups	none -> {groups,apiGroupMap}	read group metadata	FE
GET /api/getApiRoles	API.Roles -> APIRoleIDs	path,method -> authorityIds[]	read role association	FE
POST /api/setApiRoles	API.SetRoles -> SetAPIRoles	path,method,authorityIds[] -> OK	replace API-role association	FE
GET /api/syncApi	API.Sync -> SyncAPIResponses	live engine.Routes() -> sync diff	calculate registry/runtime route diff	FE
POST /api/ignoreApi	API.Ignore -> SetAPIIgnored	path,method,flag -> OK	mark route ignored for sync	FE
POST /api/enterSyncApi	API.ApplySync -> ApplyAPISyncRequest	selected sync actions -> OK	apply API registry synchronization	FE
GET /api/freshCasbin	API.FreshCasbin	none -> OK	public compatibility no-op; policy is read per authorization decision	FE
POST /casbin/updateCasbin	API.SetPolicyPaths -> SetPolicyPathsRequest	authorityId,paths[] -> OK	replace policy paths for authority	FE
POST /casbin/getPolicyPathByAuthorityId	API.PolicyPaths -> PolicyPathResponses	{authorityId} -> {paths}	read policy paths	FE

3. Users, session, and navigation

User pipeline: User/Navigation handler -> UserService -> UserUsecase -> UserRepo -> data.userRepo. Authentication paths add AuthenticationUsecase with SecurityUsecase and the audit recorder; logout uses TokenUsecase -> APITokenRepo.

Method/path	Call	Key input -> output	Primary effect	FE
POST /user/getUserList	User.List -> ListUsersRequest	UserListRequest -> Page<User>	read, data-scope aware	FE
POST /user/admin_register	User.Create -> CreateUserRequest	UserRequest -> {user}	create user; password-policy validation	FE
PUT /user/setUserInfo	User.Update -> UpdateUserRequest	UserRequest(id,profile) -> OK	update selected user	FE
PUT /user/setSelfInfo	User.UpdateSelf -> UpdateSelfUser	authenticated SelfUserRequest -> OK	update current user's profile	FE
DELETE /user/deleteUser	User.Delete -> DeleteUser	{id} -> OK	delete user	FE
POST /user/resetPassword	User.ResetPassword -> ResetPassword	id,password -> OK	set another user's password	FE
POST /user/changePassword	User.ChangePassword -> ChangePassword	current and new passwords -> OK	verify and replace current password	FE
PUT /user/setSelfSetting	User.SetSelfSetting -> SetUserSetting	current-user UI settings -> OK	persist user settings	FE
POST /user/setUserAuthorities	User.SetAuthorities -> SetUserAuthorities	id,authorityIds[] -> OK	replace user authority groups	FE
POST /user/setUserAuthority	User.SwitchAuthority -> AuthService.SwitchAuthority	current claims + authorityId -> new token/user	switch active authority and issue new token	FE
GET /user/getUserInfo	User.Get -> UserByUUID	current claims -> {user}	read self/authority info	FE
POST /menu/getMenu	Navigation.Menu -> UserService.Menus	current authority -> menu tree	read authorized navigation	FE
POST /jwt/jsonInBlacklist	Session.Logout -> TokenService.BlacklistToken	bearer token -> OK	blacklist/revoke token	FE

4. Authorities, menus, and button permissions

Authority and permissions pipeline: handler -> AuthorityService/PermissionService -> AuthorityUsecase/PermissionUsecase -> AuthorityAccessRepo/PermissionRepo -> data. Menu pipeline: Menu handler -> MenuService -> MenuUsecase -> MenuRepo -> data.menuRepo.

Method/path	Call	Key input -> output	Primary effect	FE
POST /authority/getAuthorityList	Authority.List -> Authorities	none -> authority tree/list	read	FE
POST /authority/createAuthority	Authority.Create -> CreateAuthorityRequest	authority id/name -> {authority}	create authority	FE
POST /authority/copyAuthority	Authority.Copy -> CopyAuthorityRequest	source + new authority -> {authority}	duplicate authority permissions/menu relations	FE
PUT /authority/updateAuthority	Authority.Update -> UpdateAuthorityRequest	authority fields -> {authority}	update authority	FE
POST /authority/deleteAuthority	Authority.Delete -> DeleteAuthority	{authorityId} -> OK	delete authority subject to repo rules	FE
POST /authority/setRoleUsers	Authority.SetUsers -> SetAuthorityUsers	authority/user ids -> OK	replace authority-user relation	FE
GET /authority/getUsersByAuthority	Authority.Users -> AuthorityUserIDs	authorityId -> userIds[]	read relation	FE
POST /authority/setDataScope	Authority.SetDataScope -> SetDataScope	scope and department ids -> OK	update data-scope and departments	FE
GET /authority/getDataScopeDepts	Authority.DataScopeDepartments -> DataScopeDepartmentIDs	authorityId -> departmentIds[]	read custom scope departments	FE
POST /menu/getMenuList	Menu.List -> Tree	none -> menu tree	read	FE
POST /menu/getBaseMenuTree	Menu.Tree -> Tree	none -> {menus}	read	FE
POST /menu/addBaseMenu	Menu.Create -> Create	MenuRequest -> OK	create menu, parameters/buttons	FE
POST /menu/updateBaseMenu	Menu.Update -> Update	MenuRequest -> OK	update menu	FE
POST /menu/deleteBaseMenu	Menu.Delete -> Delete	{id} -> OK	delete menu and dependent mappings per repo	FE
POST /menu/getBaseMenuById	Menu.Find -> Find	{id} -> {menu}	read	FE
POST /menu/addMenuAuthority	Menu.SetAuthorityMenus -> SetAuthorityMenus	authority + menu ids -> OK	replace authority-menu mapping	FE
POST /menu/getMenuAuthority	Menu.AuthorityMenus -> AuthorityMenus	{authorityId} -> {menus}	read mapping	FE
GET /menu/getMenuRoles	Menu.RoleIDs + DefaultRouterRoleIDs	menuId -> {authorityIds,defaultRouterAuthorityIds}	read role mapping	FE
POST /menu/setMenuRoles	Menu.SetRoles -> SetRoles	menu + authority ids -> OK	replace menu-role mapping	FE
POST /authorityBtn/getAuthorityBtn	Permission.Buttons -> SelectedButtons	authority/menu ids -> selection	read button permission selection	FE
POST /authorityBtn/setAuthorityBtn	Permission.SetButtons -> SetSelectedButtons	authority/menu/selected -> OK	replace button permission selection	FE
POST /authorityBtn/canRemoveAuthorityBtn	Permission.CanRemoveButton -> CanRemoveButton	menu button id -> boolean	dependency/usage check	FE

5. Departments and positions

Department pipeline: Organization handler -> DepartmentService -> DepartmentUsecase -> DepartmentRepo -> data.departmentRepo. Position rows substitute the matching Position* components and data.positionRepo.

Method/path	Call	Key input -> output	Primary effect	FE
POST /department/getDepartmentList	Organization.ListDepartments -> Departments	filter body -> department tree/list	read	FE
POST /department/createDepartment	CreateDepartment -> DepartmentService.Create	DepartmentRequest -> OK	create department	FE
PUT /department/updateDepartment	UpdateDepartment -> Update	DepartmentRequest -> OK	update department	FE
DELETE /department/deleteDepartment	DeleteDepartment -> Delete	{id} -> OK	delete department	FE
GET /department/findDepartment	FindDepartment -> Department	id -> department	read	FE
GET /department/getDepartmentUsers	DepartmentUsers -> UserIDs	departmentId -> userIds[]	read membership	FE
POST /department/setDepartmentUsers	SetDepartmentUsers -> SetUsers	department/user ids -> OK	replace department membership	FE
POST /user/setUserDepartments	SetUserDepartments -> DepartmentService.SetUserDepartments	user + department ids -> OK	replace user's departments	FE
POST /position/getPositionList	ListPositions -> Positions	filter body -> position list	read	FE
POST /position/createPosition	CreatePosition -> PositionService.Create	PositionRequest -> OK	create position	FE
PUT /position/updatePosition	UpdatePosition -> Update	PositionRequest -> OK	update position	FE
DELETE /position/deletePosition	DeletePosition -> Delete	{id} -> OK	delete position	FE
GET /position/findPosition	FindPosition -> Position	id -> position	read	FE
GET /position/getPositionUsers	PositionUsers -> UserIDs	positionId -> userIds[]	read membership	FE
POST /position/setPositionUsers	SetPositionUsers -> SetUsers	position/user ids -> OK	replace position membership	FE
POST /user/setUserPositions	SetUserPositions -> PositionService.SetUserPositions	user + position ids -> OK	replace user's positions	FE

6. Dictionaries

Pipeline: Dictionary handler -> DictionaryService -> DictionaryUsecase -> DictionaryRepo -> data.dictionaryRepo.

Method/path	Call	Key input -> output	Primary effect	FE
POST /sysDictionary/createSysDictionary	Create -> CreateDictionaryRequest	dictionary DTO -> {dictionary}	create dictionary	FE
PUT /sysDictionary/updateSysDictionary	Update -> UpdateDictionaryRequest	dictionary DTO -> OK	update dictionary	FE
DELETE /sysDictionary/deleteSysDictionary	Delete -> DeleteDictionary	id -> OK	delete dictionary	FE
GET /sysDictionary/findSysDictionary	Find -> Dictionary	id/type/status -> {sysDictionary}	read dictionary	FE
GET /sysDictionary/getSysDictionaryList	List(false) -> Dictionaries	page/name/type -> Page<Dictionary>	read without details	FE
GET /sysDictionary/getSysDictionaryListWithDetails	List(true) -> Dictionaries	page/name/type -> Page<Dictionary+details>	read with details	--
GET /sysDictionary/exportSysDictionary	Export -> ExportDictionary	id -> dictionary export payload	read/export JSON structure	FE
POST /sysDictionary/importSysDictionary	Import -> ImportDictionaryJSON	JSON document -> OK	validate and import dictionary	FE
POST /sysDictionaryDetail/createSysDictionaryDetail	CreateDetail -> CreateDictionaryDetailRequest	detail DTO -> OK	create detail	FE
PUT /sysDictionaryDetail/updateSysDictionaryDetail	UpdateDetail -> UpdateDictionaryDetailRequest	detail DTO -> OK	update detail	FE
DELETE /sysDictionaryDetail/deleteSysDictionaryDetail	DeleteDetail -> DeleteDictionaryDetail	id -> OK	delete detail	FE
GET /sysDictionaryDetail/findSysDictionaryDetail	FindDetail -> DictionaryDetail	id -> {sysDictionaryDetail}	read detail	FE
GET /sysDictionaryDetail/getSysDictionaryDetailList	Details -> DictionaryDetails	page/filter -> Page<Detail>	read	FE
GET /sysDictionaryDetail/getDictionaryTreeList	Tree(false) -> DictionaryTree	id -> tree	read tree by id	FE
GET /sysDictionaryDetail/getDictionaryTreeListByType	Tree(true) -> DictionaryTree	type -> tree	read tree by type	FE
GET /sysDictionaryDetail/getDictionaryDetailsByParent	DetailsByParent -> DictionaryDetailsByParent	dictionary/parent/includeChildren -> details	read descendants	FE
GET /sysDictionaryDetail/getDictionaryPath	Path -> DictionaryPath	id -> ancestor path	read ancestry	FE

7. Parameters, API tokens, security, and system configuration

Method/path	Call	Key input -> output	Primary effect	FE
POST /sysParams/createSysParams	Parameter.Create -> CreateParameterRequest -> ParameterUsecase -> ParameterRepo	parameter DTO -> OK	create parameter	FE
PUT /sysParams/updateSysParams	Parameter.Update -> UpdateParameterRequest -> ParameterUsecase -> ParameterRepo	parameter DTO -> OK	update parameter	FE
DELETE /sysParams/deleteSysParams	Parameter.Delete -> DeleteParameters -> ParameterUsecase -> ParameterRepo	ID query -> OK	delete parameter	FE
DELETE /sysParams/deleteSysParamsByIds	Parameter.DeleteMany -> DeleteParameters -> ParameterUsecase -> ParameterRepo	IDs[] -> OK	batch delete	FE
GET /sysParams/findSysParams	Parameter.Find -> ParameterByID -> ParameterUsecase -> ParameterRepo	ID -> parameter	read	FE
GET /sysParams/getSysParam	Parameter.Get -> ParameterByKey -> ParameterUsecase -> ParameterRepo	key -> parameter	read by key	FE
GET /sysParams/getSysParamsList	Parameter.List -> ParametersFilter -> ParameterUsecase -> ParameterRepo	page/name/key/date -> Page<Parameter>	read	FE
POST /sysApiToken/createApiToken	APIToken.Create -> TokenService.CreateAPIToken -> TokenUsecase -> APITokenRepo	user/authority/days/remark -> token	issue persisted API token	FE
POST /sysApiToken/getApiTokenList	APIToken.List -> APITokens -> TokenUsecase -> APITokenRepo	page/user/status -> Page<Token>	read	FE
POST /sysApiToken/deleteApiToken	APIToken.Delete -> DisableAPIToken -> TokenUsecase -> APITokenRepo	id -> OK	disable token	FE
GET /securityConfig/getSecurityConfig	SystemConfig.GetSecurity -> SecurityService.Security -> SecurityUsecase -> SecurityRepo	none -> security config	read	FE
POST /securityConfig/setSecurityConfig	SystemConfig.SetSecurity -> SaveSecurityRequest -> SecurityUsecase -> SecurityRepo	security DTO -> config	update security/rate/password policies	FE
POST /system/getSystemConfig	SystemConfig.Get -> SystemConfigService.Get -> SystemConfigUsecase -> InitializationRepo	none -> config document	read runtime config	FE
POST /system/setSystemConfig	SystemConfig.Set -> Set -> SystemConfigUsecase -> InitializationRepo	config document -> OK	persist runtime config	FE
POST /system/reloadSystem	SystemConfig.Reload -> Reload -> SystemConfigUsecase + TaskRuntime	none -> OK	reload runtime config/task schedule	FE
POST /system/getServerInfo	SystemConfig.ServerInfo -> SystemInfo	none -> host/process metrics	read system state	FE

8. Operation, login, data-access, file-log, and error audit

Audit pipeline: Audit handler -> AuditService -> AuditUsecase -> AuditQueryRepo -> data.auditRepo. Log viewer uses LogViewerService -> LogViewerUsecase -> LogFileRepo -> data.logFileRepo. Error-record rows use the audit repository's error-record implementation. The public error creation route is intentionally callable by the frontend error handler.

Method/path	Call	Key input -> output	Primary effect	FE
GET /sysOperationRecord/getSysOperationRecordList	Audit.Operations -> OperationsFilter	page/path/method/status -> Page<Operation>	read	FE
GET /sysOperationRecord/findSysOperationRecord	Audit.Operation -> Operation	id -> operation	read	--
DELETE /sysOperationRecord/deleteSysOperationRecord	Audit.DeleteOperation -> DeleteOperations	id -> OK	delete record	FE
DELETE /sysOperationRecord/deleteSysOperationRecordByIds	Audit.DeleteOperations -> DeleteOperations	ids[] -> OK	batch delete	FE
GET /sysLoginLog/getLoginLogList	Audit.Logins -> LoginsFilter	page/username/status -> Page<LoginLog>	read	FE
GET /sysLoginLog/findLoginLog	Audit.Login -> Login	id -> login log	read	FE
DELETE /sysLoginLog/deleteLoginLog	Audit.DeleteLogin -> DeleteLogins	id -> OK	delete login log	FE
DELETE /sysLoginLog/deleteLoginLogByIds	Audit.DeleteLogins -> DeleteLogins	ids[] -> OK	batch delete	FE
POST /dataAccessLog/getDataAccessLogList	Audit.DataAccess -> DataAccessRequest	filter/page -> Page<DataAccessLog>	read	FE
DELETE /dataAccessLog/deleteDataAccessLogByIds	Audit.DeleteDataAccess -> DeleteDataAccess	ids[] -> OK	batch delete	FE
GET /logViewer/dates	Audit.LogDates -> LogViewerService.LogDates	month -> dates	read filesystem log index	FE
GET /logViewer/files	Audit.LogFiles -> LogViewerService.LogFiles	date -> files	read filesystem log index	FE
GET /logViewer/content	Audit.LogContent -> LogViewerService.LogContent	date/path/cursor -> chunk	read log content, cursor pagination	FE
POST /sysError/createSysError	Audit.CreateError -> AuditRecorder.RecordError	frontend error payload -> OK	public append error record	FE
GET /sysError/getSysErrorList	Audit.Errors -> ErrorsFilter	page/form/info/date -> Page<Error>	read	FE
GET /sysError/findSysError	Audit.Error -> Error	id -> error record	read	FE
PUT /sysError/updateSysError	Audit.UpdateError -> UpdateErrorRequest	error mutation -> OK	update error record	FE
DELETE /sysError/deleteSysError	Audit.DeleteError -> DeleteErrors	id -> OK	delete error record	FE
DELETE /sysError/deleteSysErrorByIds	Audit.DeleteErrors -> DeleteErrors	ids[] -> OK	batch delete	FE

9. Export templates and versions

Export pipeline: Export handler -> ExportService -> ExportUsecase -> ExportRepo -> data.exportRepo, with short-lived download tokens in the cache. Version pipeline: Version handler -> VersionService -> VersionUsecase -> VersionRepo -> data.versionRepo; export and import also read/write menus, APIs, and dictionaries through VersionUsecase.

Method/path	Call	Key input -> output	Primary effect	FE
POST /sysExportTemplate/createSysExportTemplate	Export.Create -> CreateRequest	template DTO -> OK	create template	FE
PUT /sysExportTemplate/updateSysExportTemplate	Export.Update -> UpdateRequest	template DTO -> OK	update template	FE
DELETE /sysExportTemplate/deleteSysExportTemplate	Export.Delete -> Delete	id -> OK	delete template	FE
DELETE /sysExportTemplate/deleteSysExportTemplateByIds	Export.DeleteMany -> Delete	ids[] -> OK	batch delete	FE
GET /sysExportTemplate/findSysExportTemplate	Export.Find -> Template	id/templateID -> template	read	FE
GET /sysExportTemplate/getSysExportTemplateList	Export.List -> TemplatesFilter	page/name/table/template/date -> Page<Template>	read	FE
GET /sysExportTemplate/previewSQL	Export.Preview -> Preview	templateID + query params -> SQL	render query only	FE
GET /sysExportTemplate/exportExcel	Export.Issue(false) -> IssueToken	templateID + params -> download token	cache token; no file yet	FE
GET /sysExportTemplate/exportTemplate	Export.Issue(true) -> IssueToken	templateID -> download token	cache blank-template token	FE
POST /sysExportTemplate/importExcel	Export.Import -> Import	multipart file + templateID -> OK	parse/import spreadsheet	--
GET /sysExportTemplate/exportExcelByToken	Export.Download(false) -> ConsumeToken + Export	token -> XLSX stream	public, one-time token consumption and file generation	--
GET /sysExportTemplate/exportTemplateByToken	Export.Download(true) -> ConsumeToken + ExportBlankTemplate	token -> XLSX stream	public, one-time token consumption and blank template	--
DELETE /sysVersion/deleteSysVersion	Version.Delete -> DeleteVersions	ID -> OK	delete version record	FE
DELETE /sysVersion/deleteSysVersionByIds	Version.DeleteMany -> DeleteVersions	IDs[] -> OK	batch delete	FE
GET /sysVersion/findSysVersion	Version.Find -> Version	ID -> version	read	FE
GET /sysVersion/getSysVersionList	Version.List -> Versions	page/name/code/date -> Page<Version>	read	FE
POST /sysVersion/exportVersion	Version.Export -> BuildVersionBundle/CreateVersion	version metadata + menu/API/dict ids -> OK	compose and persist version JSON	FE
GET /sysVersion/downloadVersionJson	Version.Download -> VersionData	ID -> JSON attachment	create/download serialized version	FE
POST /sysVersion/importVersion	Version.Import -> ImportRequest/ImportVersionBundle	version JSON DTO -> OK	import menu/API/dictionary bundle and record import	FE

10. Scheduled tasks and media

Task pipeline: Task handler -> TaskService -> TaskApplicationUsecase -> TaskUsecase -> TaskRepo -> data.taskRepo, plus the worker scheduler/runtime. Media pipeline: Media handler -> MediaService -> MediaUsecase -> MediaRepo -> data.mediaRepo, using configured object/local storage and upload-session persistence.

Method/path	Call	Key input -> output	Primary effect	FE
POST /timedTask/createTimedTask	Task.Create -> CreateRequest	task cron/executor DTO -> OK	persist task and schedule it	FE
PUT /timedTask/updateTimedTask	Task.Update -> UpdateRequest	task DTO -> OK	update and reschedule	FE
DELETE /timedTask/deleteTimedTask	Task.Delete -> Delete	{id} -> OK	unschedule and delete task	FE
POST /timedTask/toggleTimedTask	Task.Toggle -> Toggle	id,enabled -> OK	enable/disable schedule	FE
POST /timedTask/triggerTimedTask	Task.Trigger -> Trigger	{id} -> OK	enqueue/manual execute; log result asynchronously	FE
GET /timedTask/getTimedTaskList	Task.List -> ListRequest	page/name/type/enabled -> Page<Task>	read	FE
GET /timedTask/getTimedTaskLogList	Task.Logs -> Logs	page/task/status -> Page<TaskLog>	read	FE
GET /timedTask/getRegisteredMethods	Task.Methods -> RegisteredMethods	none -> {methods}	read task method registry	FE
GET /timedTask/alertStream	Task.AlertStream -> Subscribe	authenticated SSE -> event stream	subscribe/unsubscribe user failure alerts	FE-direct
POST /fileUploadAndDownload/upload	Media.Upload -> Upload	multipart file/category/save -> media item	write storage; optionally persist metadata	FE
POST /fileUploadAndDownload/getFileList	Media.List -> MediaList	media filter/page -> Page<Media>	read	FE
POST /fileUploadAndDownload/deleteFile	Media.Delete -> Delete	{id} -> OK	delete metadata and storage object	FE
POST /fileUploadAndDownload/deleteFiles	Media.DeleteMany -> Delete	ids[] -> OK	batch delete files	--
GET /fileUploadAndDownload/findFile	Media.Find -> Media	id -> media item	read	--
POST /fileUploadAndDownload/editFileName	Media.Rename -> Rename	id,name -> OK	rename metadata/storage object per backend	FE
POST /fileUploadAndDownload/importURL	Media.ImportURLs -> ImportURLRequests	URL items -> OK	import remote media references	FE
POST /fileUploadAndDownload/listOssFiles	Media.Storage -> Storage	prefix/cursor/limit -> object page	list configured object storage	--
GET /attachmentCategory/getCategoryList	Media.Categories -> Categories	none -> categories	read	FE
POST /attachmentCategory/addCategory	Media.SaveCategory -> SaveCategoryRequest	category DTO -> OK	create/update category	FE
POST /attachmentCategory/deleteCategory	Media.DeleteCategory -> DeleteCategory	{id} -> OK	delete category	FE
POST /mediaUpload/init	Media.InitUpload -> InitUpload	name/hash/size/chunk metadata -> session/status	create/resume multipart upload session	FE
POST /mediaUpload/chunk	Media.SaveChunk -> SaveChunk	multipart chunk + upload/index/hash -> OK	persist/verify upload chunk	FE
POST /mediaUpload/complete	Media.CompleteUpload -> CompleteUpload	uploadId -> media item	assemble/persist completed media	FE
DELETE /mediaUpload/:uploadId	Media.CancelUpload -> CancelUpload	path upload id -> OK	remove pending upload session/chunks	FE

11. Announcements and email

Announcement pipeline: Announcement handler -> AnnouncementService -> AnnouncementUsecase -> AnnouncementRepo -> data.announcementRepo. Email pipeline: Email handler -> EmailService -> EmailUsecase -> EmailRepo, where NewEmailRepo(runtime) uses the configured runtime mail client rather than the database.

Method/path	Visibility	Call	Key input -> output	Primary effect	FE
POST /info/createInfo	private	Announcement.Create -> Create	announcement DTO -> OK	create announcement	FE
DELETE /info/deleteInfo	private	Announcement.Delete -> Delete	ID -> OK	delete announcement	FE
DELETE /info/deleteInfoByIds	private	Announcement.DeleteByIDs -> DeleteByIDs	IDs[] -> OK	batch delete	FE
PUT /info/updateInfo	private	Announcement.Update -> Update	announcement DTO -> OK	update announcement	FE
GET /info/findInfo	private	Announcement.Find -> Find	ID -> announcement	read	FE
GET /info/getInfoList	private	Announcement.List -> List	page/date range -> Page<Announcement>	read	FE
GET /info/getInfoDataSource	public	Announcement.DataSource -> UserOptions	none -> {userID: options}	read selectable users	FE
GET /info/getInfoPublic	public	Announcement.Public	none -> compatibility text	no business read/write	--
POST /email/emailTest	private	Email.Test -> Test	none -> OK	send configured test email	FE
POST /email/sendEmail	private	Email.Send -> Send	to,subject,body -> OK	send mail	FE

Frontend coverage difference

The web client has no unmatched static API URL: all inspected service({url}) calls resolve to a registered local route, including the dynamic DELETE /mediaUpload/:uploadId. One direct browser request, GET /timedTask/alertStream, is used by EventSource and is therefore counted as covered even though it has no web/src/api/timedTask.js wrapper.

Registered routes without a current frontend API call are:

• platform/operational: GET /health, GET /swagger/*any;
• dictionary: GET /sysDictionary/getSysDictionaryListWithDetails;
• audit: GET /sysOperationRecord/findSysOperationRecord;
• export: POST /sysExportTemplate/importExcel, both public ...ByToken download routes;
• media: POST /fileUploadAndDownload/deleteFiles, GET .../findFile, POST .../listOssFiles;
• announcement compatibility endpoint: GET /info/getInfoPublic.

The first group is operational or token-follow-up behavior. The others are backend capabilities not represented by a client function today; they should be explicitly marked as deliberately backend-only or added to the frontend when a GVA behavioral comparison shows they are user-facing.

Clearly excluded from the migration parity target

The supplied GVA checkout has router modules with no corresponding local router registration: system/sys_auto_code.go, system/sys_auto_code_history.go, system/sys_skills.go, and example/exa_customer.go. Its plugin tree also contains AI/MCP/CLI/skills routes and auto/plugin-management routes. These code-generation/history, AI/LLM/MCP/skills, plugin-management, and example modules are explicitly outside this audit. The single GVA GET /sysError/getSysErrorSolution action is likewise excluded because it delegates to AutoCodeService.LLMAuto; the surrounding non-AI error CRUD is included. No parity failure should be opened for excluded routes. The local router inventory does include the GVA system/media modules that were migrated, plus the local announcement and email modules.

Audit use

For the next phase, compare each row to the same GVA route by method and path, then verify: request binding location, validation/defaulting, response envelope, authorization/data-scope behavior, database/storage transaction effects, and side effects such as cache invalidation, token consumption, scheduler reload, or mail/file output. Keep the exclusions above out of the parity score.