HTTP routes
Route registration: sumeru/core/server/web/routes_table.go. Constants: web_constants.go. Live workspace I/O is SWC JSON (GET /web/swc/workspace) plus JSON-RPC (POST /api/rpc). Do not document removed HTML-workspace POSTs as live HTTP.
Auth modes
| Mode | Meaning |
|---|---|
| None | Public (login, health, RPC with own auth) |
| Session | Requires signed-in user (sumeru_session cookie) |
Public routes
| Method | Path | Handler |
|---|---|---|
| GET | /web/login | Login form |
| POST | /web/login | Submit credentials |
| GET | /web/logout | End session |
| GET | /api/health | {"ok":true} liveness |
| POST | /api/rpc | JSON-RPC (session or API key) |
Setup (pre-init only)
| Method | Path | Purpose |
|---|---|---|
| GET | /setup | First-run wizard |
| POST | /setup/init | Initialize database |
| GET | / | Redirect → /setup |
Signed-in shell
| Method | Path | Purpose |
|---|---|---|
| GET | /web/home | App hub (installed application modules) |
| GET | /web/apps | Module catalog (install/update) |
| POST | /web/module/action | Install, uninstall, activate, deactivate |
| GET | /web/settings | Settings hub |
| GET | /web/settings/app-logs | Application log viewer |
| GET | /metrics | Prometheus metrics (requires base.group_system) |
| GET | / | Redirect → /web/home |
Workspace
The live workspace is SWC: GET /web/swc/workspace plus JSON-RPC (POST /api/rpc). Save/delete/object feedback uses env.services.notification — see SWC API and SWC notifications. Many2one typeahead and object buttons also go through RPC, not dedicated HTTP POSTs.
| Method | Path | Purpose |
|---|---|---|
| GET | /web | Workspace shell (SWC SPA) — query: action, menu_id, view_type, id, edit, model, filter, sort, offset, q |
| GET | /web/swc/workspace | SWC workspace JSON (arch + records) |
| GET | /web/swc/bus | WebSocket live outbox events (plain GET → 404) |
| GET | /web/swc/chatter | Chatter messages JSON |
| POST | /web/chatter/post | Post message (mail addon) |
| POST | /web/company/switch | Switch active company |
Removed (not registered)
These constants may remain in tests. They are not HTTP routes. SWC uses JSON-RPC only for CRUD and object actions. Historical ?msg= flash query values are not a live CRUD path.
| Method | Path | Was |
|---|---|---|
| GET | /web/rel/search | Many2one typeahead — use RPC |
| POST | /web/record/save | HTML form save + ?msg= |
| POST | /web/record/delete | HTML form delete |
| POST | /web/kanban/move | HTML kanban drag |
| POST | /web/action/object | HTML object button |
Report exchange
Session auth required. See Report engine for flows and limits.
| Method | Path | Purpose |
|---|---|---|
| GET | /web/export/csv | Download CSV report |
| GET | /web/export/pdf | Download PDF report |
| GET | /web/bulk/template | Header-only CSV template |
| POST | /web/bulk/upload | Stage CSV → redirect to mapping form |
| POST | /web/bulk/confirm | Execute import after mapping |
| POST | /web/bulk/cancel | Discard staged batch |
| POST | /web/import/csv | Legacy alias → same as bulk upload (mapping required) |
GET export (/web/export/csv, /web/export/pdf)
Query parameters:
| Param | Required | Meaning |
|---|---|---|
model | Yes | Target model technical name |
fields | Yes | Comma-separated field names |
action | No | Window action id — applies action domain on list/kanban |
id | No | Record id — single-row export from form view |
page_size | No | PDF only: a4, legal, or letter (default a4) |
Response: file download (text/csv or application/pdf).
GET bulk template (/web/bulk/template)
| Param | Required | Meaning |
|---|---|---|
model | Yes | Target model |
fields | Yes | Comma-separated fields for header row |
Response: CSV attachment (headers only).
POST bulk upload (/web/bulk/upload, /web/import/csv)
Multipart form (max 8 MB). Requires CSRF token.
| Field | Required | Meaning |
|---|---|---|
csrf_token | Yes | Session CSRF |
model | Yes | Target model |
file | Yes | CSV file |
fields | No | Comma-separated fields selected in UI |
import_mode | No | create (default) or upsert |
action | No | Source window action id |
next | No | Return URL after import (must be under /web) |
Response: redirect to sys.bulk.import mapping form.
POST bulk confirm / cancel
Form POST with CSRF. Used by alternate confirm path; primary UX uses object actions on the mapping form (action_confirm_import, action_cancel_import via JSON-RPC call).
| Field | Meaning |
|---|---|
id | Batch id (sys.bulk.import) |
column_mapping | JSON map of CSV header → model field |
skip_invalid | 1 to skip invalid rows (confirm handler) |
Confirm response: redirect to stored next URL with ?msg=imported_N_updated_N_skipped_N.
Historical ?msg= flash (removed)
Not registered for CRUD. SWC toasts come from env.services.notification, not query strings. Bulk confirm may still redirect with an imported_… query on the HTML mapping path.
User preferences
| Method | Path | Purpose |
|---|---|---|
| POST | /web/user/pinned-apps | Save pinned module list (JSON body) |
Object actions
| Method | Path | Purpose |
|---|---|---|
| POST | /web/action/reset_password | Admin reset user password |
| POST | /web/action/create_api_key | Create API key for user |
Registered object actions on records run through JSON-RPC call, not POST /web/action/object (removed).
Addon routes
Addons register additional routes via router.Register(method, path, auth, handler). Example: invoice print in the account addon — see Custom HTTP route.