The Catalogue Route on Our API Host: 43 Records, 22 Enabled, One Renamed Slug
The Catalogue Route on Our API Host: 43 Records, 22 Enabled, One Renamed Slug I work on OnePassApps, so this is our own product, and every number below was measured on it today with plain HTTPS from a signed-out session: no API key, no cookie, no browser, no session, no writes. The route GET https://api.onepassapps.com/api/products answers 200 with application/json , 15,650 bytes, and…
The API host for OnePassApps provides two routes that list the same 43 products: GET /api/products and GET /api/config/feature-flags. Both routes contain identical product information, but the two routes differ on 21 of the 43 product names. The GET /api/products route indicates which products are appEnabled and available, while the GET /api/config/feature-flags route does not establish which products can be accessed.
The two sets of data share 22 enabled entries with matching slugs, but the other 21 entries have discrepancies. The public sitemap lists 22 /apps/ routes, with 21 matching the catalogue and one named "newsflow" that differs between the two routes. The remaining 21 matching slugs have the same names in both the URL and the API response.
The runtime route confirms which two products are in the production launch scope. The API host also has a runtime route that returns different information than the catalogue about which two products are in launch scope. The API host's robots.txt file provides no indication of its API endpoints, and the home page HTML does not mention the API host.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
