[scale-ballen]

What

Removes /openapi.json, /api (the ReDoc UI, i.e. redoc_url), /redoc and the MkDocs site at /docs from WHITELISTED_ROUTES, the set of paths AgentexAuthMiddleware serves without calling the auth provider.

Nothing is unmounted. All of them are still served — they just authenticate now, like every other route. An authenticated session reaches them exactly as before.

Why

On an internet-facing deployment, an unauthenticated GET /openapi.json returns a complete description of every route, parameter, request body and response model this service exposes: the whole attack surface, enumerated, with no credential. /swagger was already authenticated, so the gap was inconsistent as well as open.

Blast radius

• Codegen is unaffected. scripts/generate_openapi_spec.py builds the committed spec in-process from fastapi_app.openapi(). It has never fetched it over HTTP.
• Local development is unaffected. With AGENTEX_AUTH_URL unset the middleware is disabled outright, so http://localhost:5003/swagger and friends keep working as documented.
• /docs (MkDocs) now requires auth. It is bundled with the service and describes its setup, so it belongs on the same side of the line — but it is one line to put back if a deployment needs it anonymous.
• Probes (/health, /healthz, /readyz, /ping, /echo), the agent registration handshake and agent forwarding are untouched.

Tests

tests/unit/api/test_auth_route_allowlist.py covers is_whitelisted_route in three groups — the schema and docs surfaces, the routes that are anonymous by design, and routes that merely share a prefix with an allowlisted one — plus a pin on the allowlist contents, so adding anonymous internet-facing surface has to be argued in review rather than slipped into a set literal.

docs/docs/development_guides/auth_provider_contract.md is updated: it published the old list.

🤖 Generated with Claude Code

Confidence Score: 5/5

The PR appears safe to merge; the previous instance-ID finding is addressed.

Summary

The PR puts the API schema and documentation behind the existing authentication provider.

• The API schema and documentation pages now go through the normal auth check.
• Metric workers get a distinct fallback ID when no pod name is set.

_{Reviews (3) · Last reviewed commit: "fix(otel): keep instance ids unique when..." · Reviewed by Greptile}