# List Every API Endpoint in a FastAPI App An agent traces FastAPI routers, dependency-based auth and request models, then checks local responses and returns a cited endpoint table. [Run this on Rush](https://cloud.getrush.ai/run/api-endpoint-inventory/fastapi/), in a Project that has your repository. ## What the agent does The agent combines router prefixes with the application's settings before listing endpoints. In fastapi/full-stack-fastapi-template, `backend/app/main.py:35` includes `api_router` with `settings.API_V1_STR`, and `backend/app/core/config.py:22` sets its default to `/api/v1`. `backend/app/api/main.py:7-14` includes login, users, utilities and items, then includes the private router only when `FASTAPI_ENV` is `development`. The inventory records that condition explicitly. A route observed in development is not automatically part of a differently configured deployment. Authentication requires following dependencies, including aliases. `backend/app/api/deps.py:49` defines `CurrentUser` through `Depends(get_current_user)`, and lines 52-57 add the superuser privilege check. `routes/items.py:15` uses `CurrentUser` in the list handler, while `routes/users.py:32-37` attaches `Depends(get_current_active_superuser)` in the decorator. The agent follows both forms. It also reads the ownership conditions inside item handlers, where a valid login alone does not authorize access to someone else's item. The parameter inventory links signatures to the SQLModel request and response classes in `backend/app/models.py`. It distinguishes UUID path values, pagination query parameters, JSON bodies and form data: `routes/login.py:25` uses `OAuth2PasswordRequestForm` rather than a JSON credential object. It compares the resulting table with the application's OpenAPI document, configured at `settings.API_V1_STR` plus `/openapi.json` in `main.py:23`. Schema output helps verify parameters, but inline ownership checks still require reading the handler. The agent checks `backend/pyproject.toml`, the dependency lock and `backend/README.md` before preparing the server. The README's local path starts PostgreSQL and Mailpit, then runs `uv sync`, `uv run bash scripts/prestart.sh` and `uv run fastapi dev`. It uses fresh sandbox database settings and test mail delivery, never a production connection string. Anonymous probes retain the original status and any redirect rather than following it into an apparent success. Local-only mutations need disposable records; blocked startup or missing permissions produce clearly unverified rows. ## Start it with one API call `POST https://api.prix.dev/o/{org}/sessions` ```json { "agent": "claude", "input": "Write endpoints.md for the attached FastAPI repository. Enumerate composed router paths and environment-conditional routes, trace Depends and Annotated aliases to authentication and privilege checks, and read request models plus inline ownership conditions. List method/path, handler file:line, path/query/body/form parameters and expected access. Compare source with OpenAPI. Prepare only a disposable local backend, database and test mail sink using documented commands, then probe every safely exercisable route without credentials and record status, response type and redirects. Separate intentional public routes from successful protected operations; label unverified checks. Do not call production, edit app source, push or open a PR.", "resources": [ { "url": "https://github.com/your-org/your-app" } ] } ``` 1. **Get an API key.** In the console, open Settings, then API keys, and create a key for your org. Send it in the Authorization header as a Bearer token. 2. **Send the request.** POST the body in request.json to https://api.prix.dev/o/{org}/sessions, with your repository as the resources URL. The run starts in its own cloud sandbox. 3. **Read what came back.** Follow the run on its live stream or wait for the run.completed webhook, then read the result and its trajectory. ## What comes back `endpoints.md` groups the API by router and includes the final URL, handler location, model references, authentication dependency, privilege requirement and observed anonymous response. A dedicated section describes environment-specific exposure and differences between OpenAPI and source. Another section lists operations that could not be exercised, with the exact setup failure or side-effect concern. Public sign-up and token issuance remain distinct from authenticated account reads and superuser administration. The reviewer checks that dependency aliases were expanded, that local environment flags match the table and that a validation error was not mistaken for successful access. A missing UUID or malformed form can stop a request before it reaches the behavior under review. The report preserves request shape and coverage limitations so another developer can repeat the check. Rush returns the answer and file artifacts through the session; the task requests documentation, not a code change or an invented security certification. ## Run it on every backend schema change Have your CI or webhook receiver submit a session when routers, dependencies or API models change. Name the intended environment in the input and use the candidate branch's GitHub `tree` URL as the repository resource. An `Idempotency-Key` lets a retry return the same session instead of launching duplicate local inventories. Your service can wait for the configured completion webhook, then read the session's artifacts. Compare access requirements and body formats as well as added paths. For example, moving a check from a handler argument to a router-wide dependency should preserve the relevant inventory rows even though their source reference changes. ## Why run it on Rush? FastAPI's dependency system makes a clean handler signature possible while hiding important access rules behind aliases. Rush gives the agent its own place to follow those imports, inspect generated schema and prepare a local backend with separate database and mail settings. Your laptop's existing development stack does not become the target of anonymous mutation probes. The session record ties a reported response to the command that requested it and the configuration that started the server. That is more useful in review than a table generated from decorators alone. You can submit inventories for different services within your concurrency allowance and receive separate reports, including honest startup failures rather than assumed HTTP results. ## Frequently asked questions ### Why inspect code when FastAPI already exposes OpenAPI? OpenAPI is useful for paths, schemas and declared security. Resource ownership and conditional behavior can live inside ordinary Python functions. The agent cross-checks schema against those functions instead of treating either source as complete by itself. ### Will the inventory include development-only routes? It includes them with their registration condition and whether they were active during the local check. In the example, the private router depends on `FASTAPI_ENV`. The report avoids presenting that development surface as an unconditional deployment route. ### Does a validation error prove an endpoint requires login? No, a malformed request may fail for reasons unrelated to authentication. The agent reads the dependency chain and uses valid local parameter shapes where safe. Static intent and observed behavior remain separate columns when one probe cannot settle the question. ### Can it safely test password recovery? Only against sandbox-owned accounts with a local test mail sink and no external recipients. Recovery endpoints can send mail even without a login. If that isolation cannot be established, the report lists the route and leaves its runtime check unverified.