APIs whose source code requires a token cannot be run without one. Open APIs never need it.
Pick an endpoint or service
Naming, style & route audit
where
kind
message
suggestion
Check every API
This never writes or deletes anything
Only an API a developer explicitly opted in with healthcheck_allowed=True is ever called here — everything else is skipped and reported as "not marked healthcheck_allowed". Nothing is called just because it showed up in the catalogue, and this can never save, update, or delete real data on its own.
status
method
target
response / reason
Create a private user
Private users log in with a username and password (token valid 1 hour) and only see the APIs you tick below — each under the category you give it. Use the edit icon in Users & access links to change APIs, categories and descriptions later.
API catalogue
Every API discovered from the app, plus any added manually below. Removing one here only hides it from the gateway and the live tester — the real route in your app is unaffected.
method
path / name
source
status
health
Publish a public group
A no-login page listing exactly the APIs you tick, at __JSCOUP_MOUNT__/<slug>, gated only by the IPs below (or open to everyone). Use the edit icon in Groups & public links to change APIs, categories and descriptions later.