diff --git a/config/quality/file-size-baseline.json b/config/quality/file-size-baseline.json
index 39eecba576..7cc769d257 100644
--- a/config/quality/file-size-baseline.json
+++ b/config/quality/file-size-baseline.json
@@ -1,5 +1,6 @@
 {
   "_rebaseline_2026_08_20_10531_freebuff_provider": "PR #10531 (adrianaryaputra, feat/freebuff-provider-support, closes #6793) own growth: src/shared/constants/providers/apikey/gateways.ts 1283->1298 (+15, the freebuff APIKEY_PROVIDERS_GATEWAYS catalog entry, additive data at the existing registry chokepoint, same god-file no-split rationale as prior gateways.ts rebaselines) and src/app/(dashboard)/dashboard/providers/[id]/components/modals/AddApiKeyModal.tsx 1062->1067 (+5, freebuff credential placeholder/hint at the existing per-provider switch chokepoint). Covered by tests/unit/freebuff-provider.test.ts (9/9 passing).",
+  "_rebaseline_2026_08_31_12212_openapi_generated": "PR #12212 (docs audit follow-up nº 3): src/app/docs/lib/openapi.generated.ts 171->1347 — the module is emitted by scripts/docs/gen-openapi-module.mjs from docs/openapi.yaml, and the spec now documents all 692 implemented routes (was 276), so the generated output grew with the spec. Frozen at the generator output size; shrink by slimming the spec, never by hand-editing the generated module. Covered by tests/unit/openapi-security-tiers.test.ts (6/6) and the check:api-docs-refs gate (692/692 paths with a real route).",
   "_rebaseline_2026_08_21_10987_logfare_provider": "PR #10987 (jonlwheat2-gif, feat/10644-logfare-provider, closes #10644) own growth: src/shared/constants/providers/apikey/gateways.ts 1298->1321 (+23, the logfare APIKEY_PROVIDERS_GATEWAYS catalog entry with Free badge/freeNote/apiHint documenting the request-logging policy, additive data at the existing registry chokepoint, same god-file no-split rationale as the prior gateways.ts rebaselines: #10531 freebuff, merge-storm 2026-08-11). Covered by tests/unit/logfare-registry.test.ts (1/1 passing).",
   "_rebaseline_2026_08_20_10574_reasoning_transport_fallback": "PR #10574 (jackjinke, fix/responses-reasoning-transport, fixes #10550) own growth: src/sse/handlers/chatHelpers.ts 1017->1019 (+2 = the new reasoningTransportFallback option threaded through executeChatWithBreaker's options destructure and its downstream handleSingleModel call, at the existing per-attempt options-passthrough chokepoint; not extractable without splitting the option-forwarding call itself). Covered by the PR's own reasoning-policy test suite (tests/unit/chatcore-translation-paths.test.ts, tests/unit/combo-attempt-body-isolation-7847.test.ts, tests/unit/reasoning-cache.test.ts, tests/unit/strip-reasoning-blobs-agentic-context-1599.test.ts among others), 446/446 focused tests passing.",
   "_rebaseline_2026_08_18_10517_zed_hosted_oauth_callback_port": "PR #10517 (phatchau036, fix/zed-hosted-oauth-callback-port) own growth: src/shared/components/OAuthModal.tsx 1131->1148 (wc -l; check-file-size.mjs counts via split(\"\\n\").length so the gate sees 1134->1149, +15/+18, crosses the frozen 1134 cap). Wires the zed-hosted native-app callback auto-complete: forceManual gating on isTrueLocalhost for zed-hosted, the loopback-redirect-URI comment block, and the exchangeToken full-URL-as-code branch, all at the existing provider-switch chokepoints this modal already carries growth for (seventh bump: 969->989->993->998->1030->1056->1100->1149; structural shrink tracked in #3501). The actual port-derivation logic lives in src/lib/oauth/providers/zed-hosted.ts (not frozen here) and was hardened during pre-merge review to use the server's own getRuntimePorts() instead of a browser-guessed scheme/port, covered by the new tests/unit/zed-hosted-loopback-port-derivation.test.ts (8/8 passing).",
@@ -495,7 +496,8 @@
       "src/shared/components/ModelSelectModal.tsx": 1138,
       "src/shared/constants/providers/apikey/gateways.ts": 1250
     },
-    "open-sse/executors/commandCode.ts": 1271
+    "open-sse/executors/commandCode.ts": 1271,
+    "src/app/docs/lib/openapi.generated.ts": 1347
   },
   "_rebaseline_base_2026_08_10_proxyfetch": "Base-red fix (green-prs sweep, issue #9985): open-sse/utils/proxyFetch.ts 1207 > cap 1000 — new proxied-TLS fetch helper introduced by the Fal reference-image work. Owner-authorized quick rebaseline to green; structural slim tracked for v3.9.0.",
   "_rebaseline_2026_07_27_v3849_train2": "Merge-train 2 (7 PRs) — owner-approved 2026-07-27. Single entry: chatCore.ts 4955->5006 (#8595, Responses multi-turn image compaction before the context hard-reject). Genuine irreducible growth at the existing compaction chokepoint in handleChatCore — the PR adds a last-resort retry against the concrete budget plus the estimateFinalInputTokens helper, both wired at the pre-existing call site rather than a new branch. Covered by tests/unit/8560-responses-image-compaction.test.ts (4 tests).",
diff --git a/docs/openapi.yaml b/docs/openapi.yaml
index 91589c56a0..cf3f9d7838 100644
--- a/docs/openapi.yaml
+++ b/docs/openapi.yaml
@@ -8290,7 +8290,6 @@ paths:
         "200":
           description: CodeWhale config entry removed.
 
-
   # --- Generated route coverage (docs audit 2026-08-31) -----------------------
   # Minimal entries for every implemented route not documented above. Methods
   # are parsed from each route.ts's exports; summaries are path-derived.
@@ -8375,6 +8374,7 @@ paths:
       tags:
         - Acp
       summary: "DELETE acp › agents"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -8382,6 +8382,7 @@ paths:
       tags:
         - Acp
       summary: "GET acp › agents"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -8389,6 +8390,7 @@ paths:
       tags:
         - Acp
       summary: "POST acp › agents"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -8604,6 +8606,7 @@ paths:
       tags:
         - Cli tools
       summary: "DELETE cli tools › forge settings"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -8611,6 +8614,7 @@ paths:
       tags:
         - Cli tools
       summary: "GET cli tools › forge settings"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -8618,6 +8622,7 @@ paths:
       tags:
         - Cli tools
       summary: "POST cli tools › forge settings"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -8626,6 +8631,7 @@ paths:
       tags:
         - Cli tools
       summary: "DELETE cli tools › grok build settings"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -8633,6 +8639,7 @@ paths:
       tags:
         - Cli tools
       summary: "GET cli tools › grok build settings"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -8640,6 +8647,7 @@ paths:
       tags:
         - Cli tools
       summary: "POST cli tools › grok build settings"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -8663,6 +8671,7 @@ paths:
       tags:
         - Cli tools
       summary: "DELETE cli tools › jcode settings"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -8670,6 +8679,7 @@ paths:
       tags:
         - Cli tools
       summary: "GET cli tools › jcode settings"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -8677,6 +8687,7 @@ paths:
       tags:
         - Cli tools
       summary: "POST cli tools › jcode settings"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -8693,6 +8704,7 @@ paths:
       tags:
         - Cli tools
       summary: "DELETE cli tools › letta settings"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -8700,6 +8712,7 @@ paths:
       tags:
         - Cli tools
       summary: "GET cli tools › letta settings"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -8707,6 +8720,7 @@ paths:
       tags:
         - Cli tools
       summary: "POST cli tools › letta settings"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -8723,6 +8737,7 @@ paths:
       tags:
         - Cli tools
       summary: "DELETE cli tools › omp settings"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -8730,6 +8745,7 @@ paths:
       tags:
         - Cli tools
       summary: "GET cli tools › omp settings"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -8737,6 +8753,7 @@ paths:
       tags:
         - Cli tools
       summary: "POST cli tools › omp settings"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -8775,6 +8792,7 @@ paths:
       tags:
         - Cli tools
       summary: "DELETE cli tools › qwen settings"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -8782,6 +8800,7 @@ paths:
       tags:
         - Cli tools
       summary: "GET cli tools › qwen settings"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -8789,6 +8808,7 @@ paths:
       tags:
         - Cli tools
       summary: "POST cli tools › qwen settings"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9075,6 +9095,7 @@ paths:
       tags:
         - Copilot
       summary: "POST copilot › chat"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9114,6 +9135,7 @@ paths:
       tags:
         - Db backups
       summary: "GET db backups › exportAll"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9145,6 +9167,7 @@ paths:
       tags:
         - Discovery
       summary: "GET discovery › results"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9153,6 +9176,7 @@ paths:
       tags:
         - Discovery
       summary: "DELETE discovery › results › <id>"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9160,6 +9184,7 @@ paths:
       tags:
         - Discovery
       summary: "GET discovery › results › <id>"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9168,6 +9193,7 @@ paths:
       tags:
         - Discovery
       summary: "POST discovery › scan"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9176,6 +9202,7 @@ paths:
       tags:
         - Discovery
       summary: "POST discovery › verify › <id>"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9448,6 +9475,7 @@ paths:
       tags:
         - Headroom
       summary: "POST headroom › start"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9464,6 +9492,7 @@ paths:
       tags:
         - Headroom
       summary: "POST headroom › stop"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9518,6 +9547,7 @@ paths:
       tags:
         - Issue agent
       summary: "GET issue agent › runs"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9525,6 +9555,7 @@ paths:
       tags:
         - Issue agent
       summary: "POST issue agent › runs"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9638,6 +9669,7 @@ paths:
       tags:
         - Local
       summary: "POST local › redis › start"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9646,6 +9678,7 @@ paths:
       tags:
         - Local
       summary: "GET local › redis › status"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9654,6 +9687,7 @@ paths:
       tags:
         - Local
       summary: "POST local › redis › stop"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9701,6 +9735,7 @@ paths:
       tags:
         - Mcp
       summary: "GET mcp › audit"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9709,6 +9744,7 @@ paths:
       tags:
         - Mcp
       summary: "GET mcp › audit › stats"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9717,6 +9753,7 @@ paths:
       tags:
         - Mcp
       summary: "GET mcp › sse"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9724,6 +9761,7 @@ paths:
       tags:
         - Mcp
       summary: "POST mcp › sse"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9732,6 +9770,7 @@ paths:
       tags:
         - Mcp
       summary: "GET mcp › status"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9740,6 +9779,7 @@ paths:
       tags:
         - Mcp
       summary: "DELETE mcp › stream"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9747,6 +9787,7 @@ paths:
       tags:
         - Mcp
       summary: "GET mcp › stream"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9754,6 +9795,7 @@ paths:
       tags:
         - Mcp
       summary: "POST mcp › stream"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9762,6 +9804,7 @@ paths:
       tags:
         - Mcp
       summary: "GET mcp › tools"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9770,6 +9813,7 @@ paths:
       tags:
         - Middleware
       summary: "GET middleware › hooks"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9777,6 +9821,7 @@ paths:
       tags:
         - Middleware
       summary: "POST middleware › hooks"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9785,6 +9830,7 @@ paths:
       tags:
         - Middleware
       summary: "DELETE middleware › hooks › <name>"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9792,6 +9838,7 @@ paths:
       tags:
         - Middleware
       summary: "GET middleware › hooks › <name>"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -9799,6 +9846,7 @@ paths:
       tags:
         - Middleware
       summary: "PUT middleware › hooks › <name>"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -10000,6 +10048,7 @@ paths:
       tags:
         - Plugins
       summary: "GET plugins"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -10007,6 +10056,7 @@ paths:
       tags:
         - Plugins
       summary: "POST plugins"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -10015,6 +10065,7 @@ paths:
       tags:
         - Plugins
       summary: "DELETE plugins › <name>"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -10022,6 +10073,7 @@ paths:
       tags:
         - Plugins
       summary: "GET plugins › <name>"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -10030,6 +10082,7 @@ paths:
       tags:
         - Plugins
       summary: "POST plugins › <name> › activate"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -10038,6 +10091,7 @@ paths:
       tags:
         - Plugins
       summary: "GET plugins › <name> › config"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -10045,6 +10099,7 @@ paths:
       tags:
         - Plugins
       summary: "PUT plugins › <name> › config"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -10053,6 +10108,7 @@ paths:
       tags:
         - Plugins
       summary: "POST plugins › <name> › deactivate"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -10061,6 +10117,7 @@ paths:
       tags:
         - Plugins
       summary: "GET plugins › marketplace"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -10069,6 +10126,7 @@ paths:
       tags:
         - Plugins
       summary: "POST plugins › marketplace › install"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -10077,6 +10135,7 @@ paths:
       tags:
         - Plugins
       summary: "POST plugins › scan"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -10138,6 +10197,7 @@ paths:
       tags:
         - Providers
       summary: "GET providers › <id> › chatgpt web codex doctor"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -10200,6 +10260,7 @@ paths:
       tags:
         - Providers
       summary: "POST providers › <id> › login"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -10238,6 +10299,7 @@ paths:
       tags:
         - Providers
       summary: "POST providers › <id> › refresh cursor"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -10396,6 +10458,7 @@ paths:
       tags:
         - Providers
       summary: "POST providers › health autopilot › actions"
+      x-always-protected: true
       responses:
         "200":
           description: OK
@@ -10436,6 +10499,7 @@ paths:
       tags:
         - Providers
       summary: "POST providers › volcengine plan › connect"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -10444,6 +10508,7 @@ paths:
       tags:
         - Providers
       summary: "POST providers › volcengine plan › connect › <sessionId> › cancel"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -10452,6 +10517,7 @@ paths:
       tags:
         - Providers
       summary: "POST providers › volcengine plan › connect › <sessionId> › code"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -10460,6 +10526,7 @@ paths:
       tags:
         - Providers
       summary: "POST providers › volcengine plan › connect › <sessionId> › identity"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -10468,6 +10535,7 @@ paths:
       tags:
         - Providers
       summary: "POST providers › volcengine plan › connect › <sessionId> › resend"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -10476,6 +10544,7 @@ paths:
       tags:
         - Providers
       summary: "GET providers › volcengine plan › connect › <sessionId> › status"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -10762,6 +10831,7 @@ paths:
       tags:
         - Services
       summary: "GET services › 9router › models"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -10770,6 +10840,7 @@ paths:
       tags:
         - Services
       summary: "POST services › 9router › provider expose"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -10778,6 +10849,7 @@ paths:
       tags:
         - Services
       summary: "GET services › cliproxy › accounts"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -10786,6 +10858,7 @@ paths:
       tags:
         - Services
       summary: "POST services › cliproxy › provider expose"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -10909,6 +10982,7 @@ paths:
       tags:
         - Settings
       summary: "GET settings › database"
+      x-always-protected: true
       responses:
         "200":
           description: OK
@@ -10916,6 +10990,7 @@ paths:
       tags:
         - Settings
       summary: "PATCH settings › database"
+      x-always-protected: true
       responses:
         "200":
           description: OK
@@ -10923,6 +10998,7 @@ paths:
       tags:
         - Settings
       summary: "PUT settings › database"
+      x-always-protected: true
       responses:
         "200":
           description: OK
@@ -10954,6 +11030,7 @@ paths:
       tags:
         - Settings
       summary: "GET settings › export json"
+      x-always-protected: true
       responses:
         "200":
           description: OK
@@ -11039,6 +11116,7 @@ paths:
       tags:
         - Settings
       summary: "POST settings › import json"
+      x-always-protected: true
       responses:
         "200":
           description: OK
@@ -11077,6 +11155,7 @@ paths:
       tags:
         - Settings
       summary: "GET settings › mitm"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11084,6 +11163,7 @@ paths:
       tags:
         - Settings
       summary: "POST settings › mitm"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11091,6 +11171,7 @@ paths:
       tags:
         - Settings
       summary: "PUT settings › mitm"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11567,6 +11648,7 @@ paths:
       tags:
         - Skills
       summary: "POST skills › collect › chaos"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11575,6 +11657,7 @@ paths:
       tags:
         - Skills
       summary: "GET skills › collect › detect"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11583,6 +11666,7 @@ paths:
       tags:
         - Skills
       summary: "POST skills › collect › install"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11700,6 +11784,7 @@ paths:
       tags:
         - System
       summary: "GET system › version"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11707,6 +11792,7 @@ paths:
       tags:
         - System
       summary: "POST system › version"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11715,6 +11801,7 @@ paths:
       tags:
         - Tools
       summary: "GET tools › agent bridge › agents › <id>"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11722,6 +11809,7 @@ paths:
       tags:
         - Tools
       summary: "PATCH tools › agent bridge › agents › <id>"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11730,6 +11818,7 @@ paths:
       tags:
         - Tools
       summary: "GET tools › agent bridge › agents › <id> › detect"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11738,6 +11827,7 @@ paths:
       tags:
         - Tools
       summary: "GET tools › agent bridge › agents › <id> › detected models"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11746,6 +11836,7 @@ paths:
       tags:
         - Tools
       summary: "GET tools › agent bridge › cert › download"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11754,6 +11845,7 @@ paths:
       tags:
         - Tools
       summary: "POST tools › agent bridge › cert › regenerate"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11762,6 +11854,7 @@ paths:
       tags:
         - Tools
       summary: "GET tools › agent bridge › config"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11769,6 +11862,7 @@ paths:
       tags:
         - Tools
       summary: "POST tools › agent bridge › config"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11777,6 +11871,7 @@ paths:
       tags:
         - Tools
       summary: "GET tools › agent bridge › diagnose"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11785,6 +11880,7 @@ paths:
       tags:
         - Tools
       summary: "POST tools › agent bridge › repair"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11793,6 +11889,7 @@ paths:
       tags:
         - Tools
       summary: "DELETE tools › agent bridge › tproxy"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11800,6 +11897,7 @@ paths:
       tags:
         - Tools
       summary: "GET tools › agent bridge › tproxy"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11807,6 +11905,7 @@ paths:
       tags:
         - Tools
       summary: "POST tools › agent bridge › tproxy"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11815,6 +11914,7 @@ paths:
       tags:
         - Tools
       summary: "POST tools › agent bridge › upstream ca › test"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11823,6 +11923,7 @@ paths:
       tags:
         - Tools
       summary: "POST tools › traffic inspector › sessions › <id> › requests"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11839,6 +11940,7 @@ paths:
       tags:
         - Tunnels
       summary: "GET tunnels › cloudflared"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11846,6 +11948,7 @@ paths:
       tags:
         - Tunnels
       summary: "POST tunnels › cloudflared"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11885,6 +11988,7 @@ paths:
       tags:
         - Tunnels
       summary: "POST tunnels › tailscale › disable"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11893,6 +11997,7 @@ paths:
       tags:
         - Tunnels
       summary: "POST tunnels › tailscale › enable"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11901,6 +12006,7 @@ paths:
       tags:
         - Tunnels
       summary: "POST tunnels › tailscale › install"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11909,6 +12015,7 @@ paths:
       tags:
         - Tunnels
       summary: "POST tunnels › tailscale › login"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -11917,6 +12024,7 @@ paths:
       tags:
         - Tunnels
       summary: "POST tunnels › tailscale › start daemon"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -12853,6 +12961,7 @@ paths:
       tags:
         - Vnc session
       summary: "GET vnc session"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -12861,6 +12970,7 @@ paths:
       tags:
         - Vnc session
       summary: "DELETE vnc session › <params>"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -12868,6 +12978,7 @@ paths:
       tags:
         - Vnc session
       summary: "GET vnc session › <params>"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
@@ -12875,6 +12986,7 @@ paths:
       tags:
         - Vnc session
       summary: "POST vnc session › <params>"
+      x-loopback-only: true
       responses:
         "200":
           description: OK
diff --git a/scripts/ad-hoc/gen-openapi-missing-paths.mjs b/scripts/ad-hoc/gen-openapi-missing-paths.mjs
index 25f0b691f4..0417c880e1 100644
--- a/scripts/ad-hoc/gen-openapi-missing-paths.mjs
+++ b/scripts/ad-hoc/gen-openapi-missing-paths.mjs
@@ -10,6 +10,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { collectApiRouteFiles, toApiUrlPath, apiRoot } from "../check/lib/apiRoutes.mjs";
+import { isLocalOnlyPath, ALWAYS_PROTECTED_API_PATHS } from "../../src/server/authz/routeGuard.ts";
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..");
 const SPEC = path.join(ROOT, "docs", "openapi.yaml");
@@ -83,17 +84,23 @@ lines.push("");
 lines.push("  # --- Generated route coverage (docs audit 2026-08-31) -----------------------");
 lines.push("  # Minimal entries for every implemented route not documented above. Methods");
 lines.push("  # are parsed from each route.ts's exports; summaries are path-derived.");
-lines.push("  # Regenerate with: node scripts/ad-hoc/gen-openapi-missing-paths.mjs --apply");
+lines.push(
+  "  # Regenerate with: node --import tsx/esm scripts/ad-hoc/gen-openapi-missing-paths.mjs --apply"
+);
 for (const [url, methods] of missing) {
   const tag = groupTag(url);
   if (!existingTags.has(tag.toLowerCase()) && !newTags.has(tag))
     newTags.set(tag, `${tag} endpoints (generated route coverage)`);
   lines.push(`  ${url}:`);
+  const loopbackOnly = isLocalOnlyPath(url);
+  const alwaysProtected = ALWAYS_PROTECTED_API_PATHS.includes(url);
   for (const method of methods.sort()) {
     lines.push(`    ${method.toLowerCase()}:`);
     lines.push(`      tags:`);
     lines.push(`        - ${tag}`);
     lines.push(`      summary: "${summaryFor(url, method)}"`);
+    if (loopbackOnly || isLocalOnlyPath(url, method)) lines.push(`      x-loopback-only: true`);
+    if (alwaysProtected) lines.push(`      x-always-protected: true`);
     lines.push(`      responses:`);
     lines.push(`        "200":`);
     lines.push(`          description: OK`);
diff --git a/skills/omni-api-keys/SKILL.md b/skills/omni-api-keys/SKILL.md
index 7501714b01..10a2795075 100644
--- a/skills/omni-api-keys/SKILL.md
+++ b/skills/omni-api-keys/SKILL.md
@@ -74,6 +74,142 @@ curl https://localhost:20128/api/keys/{id}/devices \
   -H "Authorization: Bearer $OMNIROUTE_TOKEN"
 ```
 
+### POST /api/keys/{id}/regenerate
+
+POST keys › <id> › regenerate
+
+```bash
+curl -X POST https://localhost:20128/api/keys/{id}/regenerate \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/keys/{id}/reveal
+
+GET keys › <id> › reveal
+
+```bash
+curl https://localhost:20128/api/keys/{id}/reveal \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/keys/{id}/usage-limits
+
+GET keys › <id> › usage limits
+
+```bash
+curl https://localhost:20128/api/keys/{id}/usage-limits \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/keys/groups
+
+GET keys › groups
+
+```bash
+curl https://localhost:20128/api/keys/groups \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/keys/groups
+
+POST keys › groups
+
+```bash
+curl -X POST https://localhost:20128/api/keys/groups \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/keys/groups/{id}
+
+GET keys › groups › <id>
+
+```bash
+curl https://localhost:20128/api/keys/groups/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/keys/groups/{id}
+
+PUT keys › groups › <id>
+
+```bash
+curl -X PUT https://localhost:20128/api/keys/groups/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/keys/groups/{id}
+
+DELETE keys › groups › <id>
+
+```bash
+curl -X DELETE https://localhost:20128/api/keys/groups/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/keys/groups/{id}/keys
+
+GET keys › groups › <id> › keys
+
+```bash
+curl https://localhost:20128/api/keys/groups/{id}/keys \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/keys/groups/{id}/keys
+
+POST keys › groups › <id> › keys
+
+```bash
+curl -X POST https://localhost:20128/api/keys/groups/{id}/keys \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/keys/groups/{id}/keys
+
+DELETE keys › groups › <id> › keys
+
+```bash
+curl -X DELETE https://localhost:20128/api/keys/groups/{id}/keys \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/keys/groups/{id}/permissions
+
+GET keys › groups › <id> › permissions
+
+```bash
+curl https://localhost:20128/api/keys/groups/{id}/permissions \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/keys/groups/{id}/permissions
+
+POST keys › groups › <id> › permissions
+
+```bash
+curl -X POST https://localhost:20128/api/keys/groups/{id}/permissions \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/keys/groups/{id}/permissions
+
+DELETE keys › groups › <id> › permissions
+
+```bash
+curl -X DELETE https://localhost:20128/api/keys/groups/{id}/permissions \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
 ## Payloads
 
 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
diff --git a/skills/omni-auth/SKILL.md b/skills/omni-auth/SKILL.md
index bf2f046144..8d69a4ce8a 100644
--- a/skills/omni-auth/SKILL.md
+++ b/skills/omni-auth/SKILL.md
@@ -69,6 +69,24 @@ curl https://localhost:20128/api/auth/oidc/callback \
   -b cookie.jar
 ```
 
+### GET /api/auth/csrf
+
+GET auth › csrf
+
+```bash
+curl https://localhost:20128/api/auth/csrf \
+  -b cookie.jar
+```
+
+### GET /api/auth/status
+
+GET auth › status
+
+```bash
+curl https://localhost:20128/api/auth/status \
+  -b cookie.jar
+```
+
 ## Payloads
 
 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
diff --git a/skills/omni-cache/SKILL.md b/skills/omni-cache/SKILL.md
index e0fb260d1c..49e5c50bf2 100644
--- a/skills/omni-cache/SKILL.md
+++ b/skills/omni-cache/SKILL.md
@@ -52,6 +52,42 @@ curl -X DELETE https://localhost:20128/api/cache/stats \
   -H "Authorization: Bearer $OMNIROUTE_TOKEN"
 ```
 
+### GET /api/cache/entries
+
+GET cache › entries
+
+```bash
+curl https://localhost:20128/api/cache/entries \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### DELETE /api/cache/entries
+
+DELETE cache › entries
+
+```bash
+curl -X DELETE https://localhost:20128/api/cache/entries \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cache/reasoning
+
+GET cache › reasoning
+
+```bash
+curl https://localhost:20128/api/cache/reasoning \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### DELETE /api/cache/reasoning
+
+DELETE cache › reasoning
+
+```bash
+curl -X DELETE https://localhost:20128/api/cache/reasoning \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
 ## Payloads
 
 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
diff --git a/skills/omni-cli-tools/SKILL.md b/skills/omni-cli-tools/SKILL.md
index b5376cf960..4f591ca79b 100644
--- a/skills/omni-cli-tools/SKILL.md
+++ b/skills/omni-cli-tools/SKILL.md
@@ -385,6 +385,372 @@ curl -X DELETE https://localhost:20128/api/cli-tools/codewhale-settings \
   -H "Authorization: Bearer $OMNIROUTE_TOKEN"
 ```
 
+### GET /api/cli-tools/all-statuses
+
+GET cli tools › all statuses
+
+```bash
+curl https://localhost:20128/api/cli-tools/all-statuses \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/cli-tools/apply
+
+POST cli tools › apply
+
+```bash
+curl -X POST https://localhost:20128/api/cli-tools/apply \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/cli-tools/config
+
+GET cli tools › config
+
+```bash
+curl https://localhost:20128/api/cli-tools/config \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/cli-tools/config
+
+POST cli tools › config
+
+```bash
+curl -X POST https://localhost:20128/api/cli-tools/config \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/cli-tools/deepseek-tui-settings
+
+GET cli tools › deepseek tui settings
+
+```bash
+curl https://localhost:20128/api/cli-tools/deepseek-tui-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/cli-tools/deepseek-tui-settings
+
+POST cli tools › deepseek tui settings
+
+```bash
+curl -X POST https://localhost:20128/api/cli-tools/deepseek-tui-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/cli-tools/deepseek-tui-settings
+
+DELETE cli tools › deepseek tui settings
+
+```bash
+curl -X DELETE https://localhost:20128/api/cli-tools/deepseek-tui-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cli-tools/detect
+
+GET cli tools › detect
+
+```bash
+curl https://localhost:20128/api/cli-tools/detect \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cli-tools/forge-settings
+
+GET cli tools › forge settings
+
+```bash
+curl https://localhost:20128/api/cli-tools/forge-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/cli-tools/forge-settings
+
+POST cli tools › forge settings
+
+```bash
+curl -X POST https://localhost:20128/api/cli-tools/forge-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/cli-tools/forge-settings
+
+DELETE cli tools › forge settings
+
+```bash
+curl -X DELETE https://localhost:20128/api/cli-tools/forge-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cli-tools/grok-build-settings
+
+GET cli tools › grok build settings
+
+```bash
+curl https://localhost:20128/api/cli-tools/grok-build-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/cli-tools/grok-build-settings
+
+POST cli tools › grok build settings
+
+```bash
+curl -X POST https://localhost:20128/api/cli-tools/grok-build-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/cli-tools/grok-build-settings
+
+DELETE cli tools › grok build settings
+
+```bash
+curl -X DELETE https://localhost:20128/api/cli-tools/grok-build-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cli-tools/hermes-agent-settings
+
+GET cli tools › hermes agent settings
+
+```bash
+curl https://localhost:20128/api/cli-tools/hermes-agent-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/cli-tools/hermes-agent-settings
+
+POST cli tools › hermes agent settings
+
+```bash
+curl -X POST https://localhost:20128/api/cli-tools/hermes-agent-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/cli-tools/jcode-settings
+
+GET cli tools › jcode settings
+
+```bash
+curl https://localhost:20128/api/cli-tools/jcode-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/cli-tools/jcode-settings
+
+POST cli tools › jcode settings
+
+```bash
+curl -X POST https://localhost:20128/api/cli-tools/jcode-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/cli-tools/jcode-settings
+
+DELETE cli tools › jcode settings
+
+```bash
+curl -X DELETE https://localhost:20128/api/cli-tools/jcode-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cli-tools/keys
+
+GET cli tools › keys
+
+```bash
+curl https://localhost:20128/api/cli-tools/keys \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cli-tools/letta-settings
+
+GET cli tools › letta settings
+
+```bash
+curl https://localhost:20128/api/cli-tools/letta-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/cli-tools/letta-settings
+
+POST cli tools › letta settings
+
+```bash
+curl -X POST https://localhost:20128/api/cli-tools/letta-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/cli-tools/letta-settings
+
+DELETE cli tools › letta settings
+
+```bash
+curl -X DELETE https://localhost:20128/api/cli-tools/letta-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cli-tools/logs
+
+GET cli tools › logs
+
+```bash
+curl https://localhost:20128/api/cli-tools/logs \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cli-tools/omp-settings
+
+GET cli tools › omp settings
+
+```bash
+curl https://localhost:20128/api/cli-tools/omp-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/cli-tools/omp-settings
+
+POST cli tools › omp settings
+
+```bash
+curl -X POST https://localhost:20128/api/cli-tools/omp-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/cli-tools/omp-settings
+
+DELETE cli tools › omp settings
+
+```bash
+curl -X DELETE https://localhost:20128/api/cli-tools/omp-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cli-tools/openclaw/auto-order
+
+GET cli tools › openclaw › auto order
+
+```bash
+curl https://localhost:20128/api/cli-tools/openclaw/auto-order \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cli-tools/pi-settings
+
+GET cli tools › pi settings
+
+```bash
+curl https://localhost:20128/api/cli-tools/pi-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/cli-tools/pi-settings
+
+POST cli tools › pi settings
+
+```bash
+curl -X POST https://localhost:20128/api/cli-tools/pi-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/cli-tools/pi-settings
+
+DELETE cli tools › pi settings
+
+```bash
+curl -X DELETE https://localhost:20128/api/cli-tools/pi-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cli-tools/qwen-settings
+
+GET cli tools › qwen settings
+
+```bash
+curl https://localhost:20128/api/cli-tools/qwen-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/cli-tools/qwen-settings
+
+POST cli tools › qwen settings
+
+```bash
+curl -X POST https://localhost:20128/api/cli-tools/qwen-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/cli-tools/qwen-settings
+
+DELETE cli tools › qwen settings
+
+```bash
+curl -X DELETE https://localhost:20128/api/cli-tools/qwen-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cli-tools/smelt-settings
+
+GET cli tools › smelt settings
+
+```bash
+curl https://localhost:20128/api/cli-tools/smelt-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/cli-tools/smelt-settings
+
+POST cli tools › smelt settings
+
+```bash
+curl -X POST https://localhost:20128/api/cli-tools/smelt-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/cli-tools/smelt-settings
+
+DELETE cli tools › smelt settings
+
+```bash
+curl -X DELETE https://localhost:20128/api/cli-tools/smelt-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cli-tools/status
+
+GET cli tools › status
+
+```bash
+curl https://localhost:20128/api/cli-tools/status \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
 ## Payloads
 
 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
diff --git a/skills/omni-combos-routing/SKILL.md b/skills/omni-combos-routing/SKILL.md
index 9afb31e36d..5b14c50d94 100644
--- a/skills/omni-combos-routing/SKILL.md
+++ b/skills/omni-combos-routing/SKILL.md
@@ -131,6 +131,46 @@ curl -X DELETE https://localhost:20128/api/fallback/chains \
   -H "Authorization: Bearer $OMNIROUTE_TOKEN"
 ```
 
+### GET /api/combos/auto
+
+GET combos › auto
+
+```bash
+curl https://localhost:20128/api/combos/auto \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/combos/builder/options
+
+GET combos › builder › options
+
+```bash
+curl https://localhost:20128/api/combos/builder/options \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/combos/duplicate
+
+POST combos › duplicate
+
+```bash
+curl -X POST https://localhost:20128/api/combos/duplicate \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/combos/reorder
+
+POST combos › reorder
+
+```bash
+curl -X POST https://localhost:20128/api/combos/reorder \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
 ## Payloads
 
 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
diff --git a/skills/omni-compression/SKILL.md b/skills/omni-compression/SKILL.md
index f17f39c52f..c24c99b09a 100644
--- a/skills/omni-compression/SKILL.md
+++ b/skills/omni-compression/SKILL.md
@@ -43,6 +43,48 @@ curl https://localhost:20128/api/compression/rules \
   -H "Authorization: Bearer $OMNIROUTE_TOKEN"
 ```
 
+### POST /api/compression/compare
+
+POST compression › compare
+
+```bash
+curl -X POST https://localhost:20128/api/compression/compare \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/compression/compare/verify
+
+POST compression › compare › verify
+
+```bash
+curl -X POST https://localhost:20128/api/compression/compare/verify \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/compression/engines
+
+GET compression › engines
+
+```bash
+curl https://localhost:20128/api/compression/engines \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/compression/retrieve
+
+POST compression › retrieve
+
+```bash
+curl -X POST https://localhost:20128/api/compression/retrieve \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
 ## Payloads
 
 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
diff --git a/skills/omni-context-rtk/SKILL.md b/skills/omni-context-rtk/SKILL.md
index 8f75be1881..4feee73225 100644
--- a/skills/omni-context-rtk/SKILL.md
+++ b/skills/omni-context-rtk/SKILL.md
@@ -74,6 +74,24 @@ curl https://localhost:20128/api/context/rtk/raw-output/{id} \
   -H "Authorization: Bearer $OMNIROUTE_TOKEN"
 ```
 
+### GET /api/context/rtk/discover
+
+GET context › rtk › discover
+
+```bash
+curl https://localhost:20128/api/context/rtk/discover \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/context/rtk/learn
+
+GET context › rtk › learn
+
+```bash
+curl https://localhost:20128/api/context/rtk/learn \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
 ## Payloads
 
 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
diff --git a/skills/omni-db-backups/SKILL.md b/skills/omni-db-backups/SKILL.md
index 93fe053482..f67fad7f1e 100644
--- a/skills/omni-db-backups/SKILL.md
+++ b/skills/omni-db-backups/SKILL.md
@@ -14,7 +14,46 @@ All requests require a valid Bearer token or session cookie. Obtain a token via
 
 ## Endpoints
 
-_No endpoints mapped for this area yet._
+### GET /api/system/env/repair
+
+GET system › env › repair
+
+```bash
+curl https://localhost:20128/api/system/env/repair \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/system/env/repair
+
+POST system › env › repair
+
+```bash
+curl -X POST https://localhost:20128/api/system/env/repair \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/system/version
+
+GET system › version
+
+```bash
+curl https://localhost:20128/api/system/version \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/system/version
+
+POST system › version
+
+```bash
+curl -X POST https://localhost:20128/api/system/version \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
 ## Payloads
 
 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
diff --git a/skills/omni-inference/SKILL.md b/skills/omni-inference/SKILL.md
index ba178839a3..d5aeca9624 100644
--- a/skills/omni-inference/SKILL.md
+++ b/skills/omni-inference/SKILL.md
@@ -462,6 +462,898 @@ curl https://localhost:20128/api/v1/provider-plugin-manifest \
   -H "Authorization: Bearer $OMNIROUTE_TOKEN"
 ```
 
+### GET /api/v1/{omnirouteCatchAll}
+
+GET <omnirouteCatchAll>
+
+```bash
+curl https://localhost:20128/api/v1/{omnirouteCatchAll} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/{omnirouteCatchAll}
+
+POST <omnirouteCatchAll>
+
+```bash
+curl -X POST https://localhost:20128/api/v1/{omnirouteCatchAll} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### PUT /api/v1/{omnirouteCatchAll}
+
+PUT <omnirouteCatchAll>
+
+```bash
+curl -X PUT https://localhost:20128/api/v1/{omnirouteCatchAll} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### PATCH /api/v1/{omnirouteCatchAll}
+
+PATCH <omnirouteCatchAll>
+
+```bash
+curl -X PATCH https://localhost:20128/api/v1/{omnirouteCatchAll} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/v1/{omnirouteCatchAll}
+
+DELETE <omnirouteCatchAll>
+
+```bash
+curl -X DELETE https://localhost:20128/api/v1/{omnirouteCatchAll} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/accounts/{id}/limits
+
+GET accounts › <id> › limits
+
+```bash
+curl https://localhost:20128/api/v1/accounts/{id}/limits \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/v1/accounts/{id}/limits
+
+PUT accounts › <id> › limits
+
+```bash
+curl -X PUT https://localhost:20128/api/v1/accounts/{id}/limits \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/agents/credentials
+
+GET agents › credentials
+
+```bash
+curl https://localhost:20128/api/v1/agents/credentials \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/agents/credentials
+
+POST agents › credentials
+
+```bash
+curl -X POST https://localhost:20128/api/v1/agents/credentials \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/agents/health
+
+GET agents › health
+
+```bash
+curl https://localhost:20128/api/v1/agents/health \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/agents/tasks
+
+GET agents › tasks
+
+```bash
+curl https://localhost:20128/api/v1/agents/tasks \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/agents/tasks
+
+POST agents › tasks
+
+```bash
+curl -X POST https://localhost:20128/api/v1/agents/tasks \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/v1/agents/tasks
+
+DELETE agents › tasks
+
+```bash
+curl -X DELETE https://localhost:20128/api/v1/agents/tasks \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/agents/tasks/{id}
+
+GET agents › tasks › <id>
+
+```bash
+curl https://localhost:20128/api/v1/agents/tasks/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/agents/tasks/{id}
+
+POST agents › tasks › <id>
+
+```bash
+curl -X POST https://localhost:20128/api/v1/agents/tasks/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/v1/agents/tasks/{id}
+
+DELETE agents › tasks › <id>
+
+```bash
+curl -X DELETE https://localhost:20128/api/v1/agents/tasks/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/antigravity
+
+POST antigravity
+
+```bash
+curl -X POST https://localhost:20128/api/v1/antigravity \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/auto-combo/{channel}/candidates
+
+GET auto combo › <channel> › candidates
+
+```bash
+curl https://localhost:20128/api/v1/auto-combo/{channel}/candidates \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/batches
+
+GET batches
+
+```bash
+curl https://localhost:20128/api/v1/batches \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/batches
+
+POST batches
+
+```bash
+curl -X POST https://localhost:20128/api/v1/batches \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/batches/{id}
+
+GET batches › <id>
+
+```bash
+curl https://localhost:20128/api/v1/batches/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### DELETE /api/v1/batches/{id}
+
+DELETE batches › <id>
+
+```bash
+curl -X DELETE https://localhost:20128/api/v1/batches/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/batches/{id}/cancel
+
+POST batches › <id> › cancel
+
+```bash
+curl -X POST https://localhost:20128/api/v1/batches/{id}/cancel \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/v1/batches/delete-completed
+
+DELETE batches › delete completed
+
+```bash
+curl -X DELETE https://localhost:20128/api/v1/batches/delete-completed \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/classify
+
+POST classify
+
+```bash
+curl -X POST https://localhost:20128/api/v1/classify \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/combos
+
+GET combos
+
+```bash
+curl https://localhost:20128/api/v1/combos \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/completions
+
+POST completions
+
+```bash
+curl -X POST https://localhost:20128/api/v1/completions \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/files
+
+GET files
+
+```bash
+curl https://localhost:20128/api/v1/files \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/files
+
+POST files
+
+```bash
+curl -X POST https://localhost:20128/api/v1/files \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/files/{id}
+
+GET files › <id>
+
+```bash
+curl https://localhost:20128/api/v1/files/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### DELETE /api/v1/files/{id}
+
+DELETE files › <id>
+
+```bash
+curl -X DELETE https://localhost:20128/api/v1/files/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/files/{id}/content
+
+GET files › <id> › content
+
+```bash
+curl https://localhost:20128/api/v1/files/{id}/content \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/images/edits
+
+POST images › edits
+
+```bash
+curl -X POST https://localhost:20128/api/v1/images/edits \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/images/upscale
+
+GET images › upscale
+
+```bash
+curl https://localhost:20128/api/v1/images/upscale \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/images/upscale
+
+POST images › upscale
+
+```bash
+curl -X POST https://localhost:20128/api/v1/images/upscale \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/v1/issues/report
+
+POST issues › report
+
+```bash
+curl -X POST https://localhost:20128/api/v1/issues/report \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/management/proxies
+
+GET management › proxies
+
+```bash
+curl https://localhost:20128/api/v1/management/proxies \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/management/proxies
+
+POST management › proxies
+
+```bash
+curl -X POST https://localhost:20128/api/v1/management/proxies \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### PATCH /api/v1/management/proxies
+
+PATCH management › proxies
+
+```bash
+curl -X PATCH https://localhost:20128/api/v1/management/proxies \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/v1/management/proxies
+
+DELETE management › proxies
+
+```bash
+curl -X DELETE https://localhost:20128/api/v1/management/proxies \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/management/proxies/assignments
+
+GET management › proxies › assignments
+
+```bash
+curl https://localhost:20128/api/v1/management/proxies/assignments \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/v1/management/proxies/assignments
+
+PUT management › proxies › assignments
+
+```bash
+curl -X PUT https://localhost:20128/api/v1/management/proxies/assignments \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### PUT /api/v1/management/proxies/bulk-assign
+
+PUT management › proxies › bulk assign
+
+```bash
+curl -X PUT https://localhost:20128/api/v1/management/proxies/bulk-assign \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/management/proxies/health
+
+GET management › proxies › health
+
+```bash
+curl https://localhost:20128/api/v1/management/proxies/health \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/me/status
+
+GET me › status
+
+```bash
+curl https://localhost:20128/api/v1/me/status \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/muse-code/models
+
+GET muse code › models
+
+```bash
+curl https://localhost:20128/api/v1/muse-code/models \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/music/generations
+
+GET music › generations
+
+```bash
+curl https://localhost:20128/api/v1/music/generations \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/music/generations
+
+POST music › generations
+
+```bash
+curl -X POST https://localhost:20128/api/v1/music/generations \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/providers/{provider}/limits
+
+GET providers › <provider> › limits
+
+```bash
+curl https://localhost:20128/api/v1/providers/{provider}/limits \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/v1/providers/{provider}/limits
+
+PUT providers › <provider> › limits
+
+```bash
+curl -X PUT https://localhost:20128/api/v1/providers/{provider}/limits \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/quotas/check
+
+GET quotas › check
+
+```bash
+curl https://localhost:20128/api/v1/quotas/check \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/registered-keys
+
+GET registered keys
+
+```bash
+curl https://localhost:20128/api/v1/registered-keys \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/registered-keys
+
+POST registered keys
+
+```bash
+curl -X POST https://localhost:20128/api/v1/registered-keys \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/registered-keys/{id}
+
+GET registered keys › <id>
+
+```bash
+curl https://localhost:20128/api/v1/registered-keys/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### DELETE /api/v1/registered-keys/{id}
+
+DELETE registered keys › <id>
+
+```bash
+curl -X DELETE https://localhost:20128/api/v1/registered-keys/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/registered-keys/{id}/revoke
+
+POST registered keys › <id> › revoke
+
+```bash
+curl -X POST https://localhost:20128/api/v1/registered-keys/{id}/revoke \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/v1/relay/chat/completions
+
+POST relay › chat › completions
+
+```bash
+curl -X POST https://localhost:20128/api/v1/relay/chat/completions \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/v1/relay/chat/completions/bifrost
+
+POST relay › chat › completions › bifrost
+
+```bash
+curl -X POST https://localhost:20128/api/v1/relay/chat/completions/bifrost \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/v1/responses/{path}
+
+POST responses › <path>
+
+```bash
+curl -X POST https://localhost:20128/api/v1/responses/{path} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/search/analytics
+
+GET search › analytics
+
+```bash
+curl https://localhost:20128/api/v1/search/analytics \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/segment
+
+POST segment
+
+```bash
+curl -X POST https://localhost:20128/api/v1/segment \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/video-bridge/drilldown
+
+GET video bridge › drilldown
+
+```bash
+curl https://localhost:20128/api/v1/video-bridge/drilldown \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### DELETE /api/v1/video-bridge/drilldown
+
+DELETE video bridge › drilldown
+
+```bash
+curl -X DELETE https://localhost:20128/api/v1/video-bridge/drilldown \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/videos/generations
+
+GET videos › generations
+
+```bash
+curl https://localhost:20128/api/v1/videos/generations \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/videos/generations
+
+POST videos › generations
+
+```bash
+curl -X POST https://localhost:20128/api/v1/videos/generations \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/vscode/{token}
+
+GET vscode › <token>
+
+```bash
+curl https://localhost:20128/api/v1/vscode/{token} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/vscode/{token}/api/chat
+
+POST vscode › <token> › api › chat
+
+```bash
+curl -X POST https://localhost:20128/api/v1/vscode/{token}/api/chat \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/v1/vscode/{token}/api/show
+
+POST vscode › <token> › api › show
+
+```bash
+curl -X POST https://localhost:20128/api/v1/vscode/{token}/api/show \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/vscode/{token}/api/tags
+
+GET vscode › <token> › api › tags
+
+```bash
+curl https://localhost:20128/api/v1/vscode/{token}/api/tags \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/vscode/{token}/api/version
+
+GET vscode › <token> › api › version
+
+```bash
+curl https://localhost:20128/api/v1/vscode/{token}/api/version \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/vscode/{token}/chat/completions
+
+POST vscode › <token> › chat › completions
+
+```bash
+curl -X POST https://localhost:20128/api/v1/vscode/{token}/chat/completions \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/vscode/{token}/combos
+
+GET vscode › <token> › combos
+
+```bash
+curl https://localhost:20128/api/v1/vscode/{token}/combos \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/vscode/{token}/models
+
+GET vscode › <token> › models
+
+```bash
+curl https://localhost:20128/api/v1/vscode/{token}/models \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/vscode/{token}/responses
+
+POST vscode › <token> › responses
+
+```bash
+curl -X POST https://localhost:20128/api/v1/vscode/{token}/responses \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/v1/vscode/{token}/v1/chat/completions
+
+POST vscode › <token> › v1 › chat › completions
+
+```bash
+curl -X POST https://localhost:20128/api/v1/vscode/{token}/v1/chat/completions \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/vscode/{token}/v1/models
+
+GET vscode › <token> › v1 › models
+
+```bash
+curl https://localhost:20128/api/v1/vscode/{token}/v1/models \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/vscode/combos/{token}/{{slug}}
+
+GET vscode › combos › <token> › <{slug>}
+
+```bash
+curl https://localhost:20128/api/v1/vscode/combos/{token}/{{slug}} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/vscode/combos/{token}/{{slug}}
+
+POST vscode › combos › <token> › <{slug>}
+
+```bash
+curl -X POST https://localhost:20128/api/v1/vscode/combos/{token}/{{slug}} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/vscode/raw/{token}
+
+GET vscode › raw › <token>
+
+```bash
+curl https://localhost:20128/api/v1/vscode/raw/{token} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/vscode/raw/{token}/api/chat
+
+POST vscode › raw › <token> › api › chat
+
+```bash
+curl -X POST https://localhost:20128/api/v1/vscode/raw/{token}/api/chat \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/v1/vscode/raw/{token}/api/show
+
+POST vscode › raw › <token> › api › show
+
+```bash
+curl -X POST https://localhost:20128/api/v1/vscode/raw/{token}/api/show \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/vscode/raw/{token}/api/tags
+
+GET vscode › raw › <token> › api › tags
+
+```bash
+curl https://localhost:20128/api/v1/vscode/raw/{token}/api/tags \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/vscode/raw/{token}/api/version
+
+GET vscode › raw › <token> › api › version
+
+```bash
+curl https://localhost:20128/api/v1/vscode/raw/{token}/api/version \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/vscode/raw/{token}/chat/completions
+
+POST vscode › raw › <token> › chat › completions
+
+```bash
+curl -X POST https://localhost:20128/api/v1/vscode/raw/{token}/chat/completions \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/vscode/raw/{token}/combos
+
+GET vscode › raw › <token> › combos
+
+```bash
+curl https://localhost:20128/api/v1/vscode/raw/{token}/combos \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/vscode/raw/{token}/models
+
+GET vscode › raw › <token> › models
+
+```bash
+curl https://localhost:20128/api/v1/vscode/raw/{token}/models \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/vscode/raw/{token}/responses
+
+POST vscode › raw › <token> › responses
+
+```bash
+curl -X POST https://localhost:20128/api/v1/vscode/raw/{token}/responses \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/v1/vscode/raw/{token}/v1/chat/completions
+
+POST vscode › raw › <token> › v1 › chat › completions
+
+```bash
+curl -X POST https://localhost:20128/api/v1/vscode/raw/{token}/v1/chat/completions \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/vscode/raw/{token}/v1/models
+
+GET vscode › raw › <token> › v1 › models
+
+```bash
+curl https://localhost:20128/api/v1/vscode/raw/{token}/v1/models \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/web/fetch
+
+POST web › fetch
+
+```bash
+curl -X POST https://localhost:20128/api/v1/web/fetch \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
 ## Payloads
 
 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
diff --git a/skills/omni-mcp/SKILL.md b/skills/omni-mcp/SKILL.md
index 13f3f5f56a..d63f475d2e 100644
--- a/skills/omni-mcp/SKILL.md
+++ b/skills/omni-mcp/SKILL.md
@@ -14,7 +14,91 @@ All requests require a valid Bearer token or session cookie. Obtain a token via
 
 ## Endpoints
 
-_No endpoints mapped for this area yet._
+### GET /api/mcp/audit
+
+GET mcp › audit
+
+```bash
+curl https://localhost:20128/api/mcp/audit \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/mcp/audit/stats
+
+GET mcp › audit › stats
+
+```bash
+curl https://localhost:20128/api/mcp/audit/stats \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/mcp/sse
+
+GET mcp › sse
+
+```bash
+curl https://localhost:20128/api/mcp/sse \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/mcp/sse
+
+POST mcp › sse
+
+```bash
+curl -X POST https://localhost:20128/api/mcp/sse \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/mcp/status
+
+GET mcp › status
+
+```bash
+curl https://localhost:20128/api/mcp/status \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/mcp/stream
+
+GET mcp › stream
+
+```bash
+curl https://localhost:20128/api/mcp/stream \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/mcp/stream
+
+POST mcp › stream
+
+```bash
+curl -X POST https://localhost:20128/api/mcp/stream \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/mcp/stream
+
+DELETE mcp › stream
+
+```bash
+curl -X DELETE https://localhost:20128/api/mcp/stream \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/mcp/tools
+
+GET mcp › tools
+
+```bash
+curl https://localhost:20128/api/mcp/tools \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
 ## Payloads
 
 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
diff --git a/skills/omni-models/SKILL.md b/skills/omni-models/SKILL.md
index 4d3b9aed0b..3bc909584f 100644
--- a/skills/omni-models/SKILL.md
+++ b/skills/omni-models/SKILL.md
@@ -54,6 +54,46 @@ curl https://localhost:20128/api/models/catalog \
   -H "Authorization: Bearer $OMNIROUTE_TOKEN"
 ```
 
+### GET /api/models/openrouter-catalog
+
+GET models › openrouter catalog
+
+```bash
+curl https://localhost:20128/api/models/openrouter-catalog \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/models/test
+
+POST models › test
+
+```bash
+curl -X POST https://localhost:20128/api/models/test \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/models/test-all
+
+POST models › test all
+
+```bash
+curl -X POST https://localhost:20128/api/models/test-all \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/models/{model}
+
+GET models › <model>
+
+```bash
+curl https://localhost:20128/api/v1/models/{model} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
 ## Payloads
 
 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
diff --git a/skills/omni-providers/SKILL.md b/skills/omni-providers/SKILL.md
index 532a134e41..ff852f20a1 100644
--- a/skills/omni-providers/SKILL.md
+++ b/skills/omni-providers/SKILL.md
@@ -229,6 +229,526 @@ curl https://localhost:20128/api/provider-models \
   -H "Authorization: Bearer $OMNIROUTE_TOKEN"
 ```
 
+### GET /api/providers/{id}/cc-alias
+
+GET providers › <id> › cc alias
+
+```bash
+curl https://localhost:20128/api/providers/{id}/cc-alias \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/providers/{id}/cc-alias
+
+PUT providers › <id> › cc alias
+
+```bash
+curl -X PUT https://localhost:20128/api/providers/{id}/cc-alias \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/providers/{id}/chatgpt-web-codex-doctor
+
+GET providers › <id> › chatgpt web codex doctor
+
+```bash
+curl https://localhost:20128/api/providers/{id}/chatgpt-web-codex-doctor \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/providers/{id}/claude-auth/apply-local
+
+POST providers › <id> › claude auth › apply local
+
+```bash
+curl -X POST https://localhost:20128/api/providers/{id}/claude-auth/apply-local \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/{id}/claude-auth/export
+
+POST providers › <id> › claude auth › export
+
+```bash
+curl -X POST https://localhost:20128/api/providers/{id}/claude-auth/export \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/{id}/codex-auth/apply-local
+
+POST providers › <id> › codex auth › apply local
+
+```bash
+curl -X POST https://localhost:20128/api/providers/{id}/codex-auth/apply-local \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/{id}/codex-auth/export
+
+POST providers › <id> › codex auth › export
+
+```bash
+curl -X POST https://localhost:20128/api/providers/{id}/codex-auth/export \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/providers/{id}/interception-rules
+
+GET providers › <id> › interception rules
+
+```bash
+curl https://localhost:20128/api/providers/{id}/interception-rules \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/providers/{id}/interception-rules
+
+PUT providers › <id> › interception rules
+
+```bash
+curl -X PUT https://localhost:20128/api/providers/{id}/interception-rules \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/providers/{id}/interception-rules
+
+DELETE providers › <id> › interception rules
+
+```bash
+curl -X DELETE https://localhost:20128/api/providers/{id}/interception-rules \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/providers/{id}/login
+
+POST providers › <id> › login
+
+```bash
+curl -X POST https://localhost:20128/api/providers/{id}/login \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/providers/{id}/param-filters
+
+GET providers › <id> › param filters
+
+```bash
+curl https://localhost:20128/api/providers/{id}/param-filters \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/providers/{id}/param-filters
+
+PUT providers › <id> › param filters
+
+```bash
+curl -X PUT https://localhost:20128/api/providers/{id}/param-filters \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/providers/{id}/param-filters
+
+DELETE providers › <id> › param filters
+
+```bash
+curl -X DELETE https://localhost:20128/api/providers/{id}/param-filters \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/providers/{id}/refresh
+
+POST providers › <id> › refresh
+
+```bash
+curl -X POST https://localhost:20128/api/providers/{id}/refresh \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/{id}/refresh-cursor
+
+POST providers › <id> › refresh cursor
+
+```bash
+curl -X POST https://localhost:20128/api/providers/{id}/refresh-cursor \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/{id}/refresh-token
+
+POST providers › <id> › refresh token
+
+```bash
+curl -X POST https://localhost:20128/api/providers/{id}/refresh-token \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/{id}/sync-models
+
+POST providers › <id> › sync models
+
+```bash
+curl -X POST https://localhost:20128/api/providers/{id}/sync-models \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/bulk
+
+POST providers › bulk
+
+```bash
+curl -X POST https://localhost:20128/api/providers/bulk \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/bulk-web-session
+
+POST providers › bulk web session
+
+```bash
+curl -X POST https://localhost:20128/api/providers/bulk-web-session \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/claude-auth/import
+
+POST providers › claude auth › import
+
+```bash
+curl -X POST https://localhost:20128/api/providers/claude-auth/import \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/claude-auth/import-bulk
+
+POST providers › claude auth › import bulk
+
+```bash
+curl -X POST https://localhost:20128/api/providers/claude-auth/import-bulk \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/claude-auth/zip-extract
+
+POST providers › claude auth › zip extract
+
+```bash
+curl -X POST https://localhost:20128/api/providers/claude-auth/zip-extract \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/codex-auth/import
+
+POST providers › codex auth › import
+
+```bash
+curl -X POST https://localhost:20128/api/providers/codex-auth/import \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/codex-auth/import-bulk
+
+POST providers › codex auth › import bulk
+
+```bash
+curl -X POST https://localhost:20128/api/providers/codex-auth/import-bulk \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/codex-auth/zip-extract
+
+POST providers › codex auth › zip extract
+
+```bash
+curl -X POST https://localhost:20128/api/providers/codex-auth/zip-extract \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/command-code/auth/apply
+
+POST providers › command code › auth › apply
+
+```bash
+curl -X POST https://localhost:20128/api/providers/command-code/auth/apply \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/command-code/auth/callback
+
+POST providers › command code › auth › callback
+
+```bash
+curl -X POST https://localhost:20128/api/providers/command-code/auth/callback \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/command-code/auth/start
+
+POST providers › command code › auth › start
+
+```bash
+curl -X POST https://localhost:20128/api/providers/command-code/auth/start \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/providers/command-code/auth/status
+
+GET providers › command code › auth › status
+
+```bash
+curl https://localhost:20128/api/providers/command-code/auth/status \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/providers/command-code/auth/status
+
+POST providers › command code › auth › status
+
+```bash
+curl -X POST https://localhost:20128/api/providers/command-code/auth/status \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/providers/expiration
+
+GET providers › expiration
+
+```bash
+curl https://localhost:20128/api/providers/expiration \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/providers/free-onboarding
+
+GET providers › free onboarding
+
+```bash
+curl https://localhost:20128/api/providers/free-onboarding \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/providers/free-onboarding
+
+POST providers › free onboarding
+
+```bash
+curl -X POST https://localhost:20128/api/providers/free-onboarding \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/providers/health-autopilot
+
+GET providers › health autopilot
+
+```bash
+curl https://localhost:20128/api/providers/health-autopilot \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/providers/health-autopilot/actions
+
+POST providers › health autopilot › actions
+
+```bash
+curl -X POST https://localhost:20128/api/providers/health-autopilot/actions \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/providers/health-matrix
+
+GET providers › health matrix
+
+```bash
+curl https://localhost:20128/api/providers/health-matrix \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/providers/import
+
+POST providers › import
+
+```bash
+curl -X POST https://localhost:20128/api/providers/import \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/providers/openrouter-stats
+
+GET providers › openrouter stats
+
+```bash
+curl https://localhost:20128/api/providers/openrouter-stats \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/providers/quota-windows
+
+GET providers › quota windows
+
+```bash
+curl https://localhost:20128/api/providers/quota-windows \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/providers/volcengine-plan/connect
+
+POST providers › volcengine plan › connect
+
+```bash
+curl -X POST https://localhost:20128/api/providers/volcengine-plan/connect \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/volcengine-plan/connect/{sessionId}/cancel
+
+POST providers › volcengine plan › connect › <sessionId> › cancel
+
+```bash
+curl -X POST https://localhost:20128/api/providers/volcengine-plan/connect/{sessionId}/cancel \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/volcengine-plan/connect/{sessionId}/code
+
+POST providers › volcengine plan › connect › <sessionId> › code
+
+```bash
+curl -X POST https://localhost:20128/api/providers/volcengine-plan/connect/{sessionId}/code \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/volcengine-plan/connect/{sessionId}/identity
+
+POST providers › volcengine plan › connect › <sessionId> › identity
+
+```bash
+curl -X POST https://localhost:20128/api/providers/volcengine-plan/connect/{sessionId}/identity \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/volcengine-plan/connect/{sessionId}/resend
+
+POST providers › volcengine plan › connect › <sessionId> › resend
+
+```bash
+curl -X POST https://localhost:20128/api/providers/volcengine-plan/connect/{sessionId}/resend \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/providers/volcengine-plan/connect/{sessionId}/status
+
+GET providers › volcengine plan › connect › <sessionId> › status
+
+```bash
+curl https://localhost:20128/api/providers/volcengine-plan/connect/{sessionId}/status \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/providers/web-session-contract
+
+GET providers › web session contract
+
+```bash
+curl https://localhost:20128/api/providers/web-session-contract \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/providers/zed/discover
+
+POST providers › zed › discover
+
+```bash
+curl -X POST https://localhost:20128/api/providers/zed/discover \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/zed/import
+
+POST providers › zed › import
+
+```bash
+curl -X POST https://localhost:20128/api/providers/zed/import \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/zed/manual-import
+
+POST providers › zed › manual import
+
+```bash
+curl -X POST https://localhost:20128/api/providers/zed/manual-import \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
 ## Payloads
 
 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
diff --git a/skills/omni-resilience/SKILL.md b/skills/omni-resilience/SKILL.md
index b1a4b8f7d2..3a31382c71 100644
--- a/skills/omni-resilience/SKILL.md
+++ b/skills/omni-resilience/SKILL.md
@@ -25,6 +25,15 @@ curl https://localhost:20128/api/monitoring/health \
   -H "Authorization: Bearer $OMNIROUTE_TOKEN"
 ```
 
+### GET /api/provider-metrics
+
+GET provider metrics
+
+```bash
+curl https://localhost:20128/api/provider-metrics \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
 ## Payloads
 
 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
diff --git a/skills/omni-settings/SKILL.md b/skills/omni-settings/SKILL.md
index f3d3a2ae5a..0c21e89816 100644
--- a/skills/omni-settings/SKILL.md
+++ b/skills/omni-settings/SKILL.md
@@ -383,6 +383,981 @@ curl -X POST https://localhost:20128/api/settings/purge-usage-history \
   -d '{}'
 ```
 
+### GET /api/settings/authz-inventory
+
+GET settings › authz inventory
+
+```bash
+curl https://localhost:20128/api/settings/authz-inventory \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/auto-disable-accounts
+
+GET settings › auto disable accounts
+
+```bash
+curl https://localhost:20128/api/settings/auto-disable-accounts \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/settings/auto-disable-accounts
+
+PUT settings › auto disable accounts
+
+```bash
+curl -X PUT https://localhost:20128/api/settings/auto-disable-accounts \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/background-degradation
+
+GET settings › background degradation
+
+```bash
+curl https://localhost:20128/api/settings/background-degradation \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/background-degradation
+
+POST settings › background degradation
+
+```bash
+curl -X POST https://localhost:20128/api/settings/background-degradation \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### PUT /api/settings/background-degradation
+
+PUT settings › background degradation
+
+```bash
+curl -X PUT https://localhost:20128/api/settings/background-degradation \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/cache-config
+
+GET settings › cache config
+
+```bash
+curl https://localhost:20128/api/settings/cache-config \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/settings/cache-config
+
+PUT settings › cache config
+
+```bash
+curl -X PUT https://localhost:20128/api/settings/cache-config \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/cache-metrics
+
+GET settings › cache metrics
+
+```bash
+curl https://localhost:20128/api/settings/cache-metrics \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### DELETE /api/settings/cache-metrics
+
+DELETE settings › cache metrics
+
+```bash
+curl -X DELETE https://localhost:20128/api/settings/cache-metrics \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/cc-discovery-metrics
+
+GET settings › cc discovery metrics
+
+```bash
+curl https://localhost:20128/api/settings/cc-discovery-metrics \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/compression/rules
+
+GET settings › compression › rules
+
+```bash
+curl https://localhost:20128/api/settings/compression/rules \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/compression/run-telemetry
+
+GET settings › compression › run telemetry
+
+```bash
+curl https://localhost:20128/api/settings/compression/run-telemetry \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/database
+
+GET settings › database
+
+```bash
+curl https://localhost:20128/api/settings/database \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/settings/database
+
+PUT settings › database
+
+```bash
+curl -X PUT https://localhost:20128/api/settings/database \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### PATCH /api/settings/database
+
+PATCH settings › database
+
+```bash
+curl -X PATCH https://localhost:20128/api/settings/database \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/settings/database/refresh-stats
+
+POST settings › database › refresh stats
+
+```bash
+curl -X POST https://localhost:20128/api/settings/database/refresh-stats \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/database/vacuum
+
+GET settings › database › vacuum
+
+```bash
+curl https://localhost:20128/api/settings/database/vacuum \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/database/vacuum
+
+POST settings › database › vacuum
+
+```bash
+curl -X POST https://localhost:20128/api/settings/database/vacuum \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/export-json
+
+GET settings › export json
+
+```bash
+curl https://localhost:20128/api/settings/export-json \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/favicon
+
+GET settings › favicon
+
+```bash
+curl https://localhost:20128/api/settings/favicon \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/feature-flags
+
+GET settings › feature flags
+
+```bash
+curl https://localhost:20128/api/settings/feature-flags \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/settings/feature-flags
+
+PUT settings › feature flags
+
+```bash
+curl -X PUT https://localhost:20128/api/settings/feature-flags \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/settings/feature-flags
+
+DELETE settings › feature flags
+
+```bash
+curl -X DELETE https://localhost:20128/api/settings/feature-flags \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/free-proxies
+
+GET settings › free proxies
+
+```bash
+curl https://localhost:20128/api/settings/free-proxies \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### DELETE /api/settings/free-proxies
+
+DELETE settings › free proxies
+
+```bash
+curl -X DELETE https://localhost:20128/api/settings/free-proxies \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/free-proxies/{id}/add-to-pool
+
+POST settings › free proxies › <id> › add to pool
+
+```bash
+curl -X POST https://localhost:20128/api/settings/free-proxies/{id}/add-to-pool \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/settings/free-proxies/bulk-add-to-pool
+
+POST settings › free proxies › bulk add to pool
+
+```bash
+curl -X POST https://localhost:20128/api/settings/free-proxies/bulk-add-to-pool \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/free-proxies/stats
+
+GET settings › free proxies › stats
+
+```bash
+curl https://localhost:20128/api/settings/free-proxies/stats \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/free-proxies/sync
+
+POST settings › free proxies › sync
+
+```bash
+curl -X POST https://localhost:20128/api/settings/free-proxies/sync \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/settings/import-json
+
+POST settings › import json
+
+```bash
+curl -X POST https://localhost:20128/api/settings/import-json \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/settings/lkgp-cache
+
+DELETE settings › lkgp cache
+
+```bash
+curl -X DELETE https://localhost:20128/api/settings/lkgp-cache \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/local-corpus
+
+GET settings › local corpus
+
+```bash
+curl https://localhost:20128/api/settings/local-corpus \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/local-corpus
+
+POST settings › local corpus
+
+```bash
+curl -X POST https://localhost:20128/api/settings/local-corpus \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/settings/local-corpus
+
+DELETE settings › local corpus
+
+```bash
+curl -X DELETE https://localhost:20128/api/settings/local-corpus \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/mitm
+
+GET settings › mitm
+
+```bash
+curl https://localhost:20128/api/settings/mitm \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/mitm
+
+POST settings › mitm
+
+```bash
+curl -X POST https://localhost:20128/api/settings/mitm \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### PUT /api/settings/mitm
+
+PUT settings › mitm
+
+```bash
+curl -X PUT https://localhost:20128/api/settings/mitm \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/model-aliases
+
+GET settings › model aliases
+
+```bash
+curl https://localhost:20128/api/settings/model-aliases \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/model-aliases
+
+POST settings › model aliases
+
+```bash
+curl -X POST https://localhost:20128/api/settings/model-aliases \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### PUT /api/settings/model-aliases
+
+PUT settings › model aliases
+
+```bash
+curl -X PUT https://localhost:20128/api/settings/model-aliases \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/settings/model-aliases
+
+DELETE settings › model aliases
+
+```bash
+curl -X DELETE https://localhost:20128/api/settings/model-aliases \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/models-dev
+
+GET settings › models dev
+
+```bash
+curl https://localhost:20128/api/settings/models-dev \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/models-dev
+
+POST settings › models dev
+
+```bash
+curl -X POST https://localhost:20128/api/settings/models-dev \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/notion
+
+GET settings › notion
+
+```bash
+curl https://localhost:20128/api/settings/notion \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/notion
+
+POST settings › notion
+
+```bash
+curl -X POST https://localhost:20128/api/settings/notion \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/settings/notion
+
+DELETE settings › notion
+
+```bash
+curl -X DELETE https://localhost:20128/api/settings/notion \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/obsidian
+
+GET settings › obsidian
+
+```bash
+curl https://localhost:20128/api/settings/obsidian \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/obsidian
+
+POST settings › obsidian
+
+```bash
+curl -X POST https://localhost:20128/api/settings/obsidian \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/settings/obsidian
+
+DELETE settings › obsidian
+
+```bash
+curl -X DELETE https://localhost:20128/api/settings/obsidian \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/obsidian/webdav
+
+GET settings › obsidian › webdav
+
+```bash
+curl https://localhost:20128/api/settings/obsidian/webdav \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/obsidian/webdav
+
+POST settings › obsidian › webdav
+
+```bash
+curl -X POST https://localhost:20128/api/settings/obsidian/webdav \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/settings/obsidian/webdav
+
+DELETE settings › obsidian › webdav
+
+```bash
+curl -X DELETE https://localhost:20128/api/settings/obsidian/webdav \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/oneproxy
+
+GET settings › oneproxy
+
+```bash
+curl https://localhost:20128/api/settings/oneproxy \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/oneproxy
+
+POST settings › oneproxy
+
+```bash
+curl -X POST https://localhost:20128/api/settings/oneproxy \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/settings/oneproxy
+
+DELETE settings › oneproxy
+
+```bash
+curl -X DELETE https://localhost:20128/api/settings/oneproxy \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/oneproxy/rotate
+
+POST settings › oneproxy › rotate
+
+```bash
+curl -X POST https://localhost:20128/api/settings/oneproxy/rotate \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/proxies
+
+GET settings › proxies
+
+```bash
+curl https://localhost:20128/api/settings/proxies \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/proxies
+
+POST settings › proxies
+
+```bash
+curl -X POST https://localhost:20128/api/settings/proxies \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### PATCH /api/settings/proxies
+
+PATCH settings › proxies
+
+```bash
+curl -X PATCH https://localhost:20128/api/settings/proxies \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/settings/proxies
+
+DELETE settings › proxies
+
+```bash
+curl -X DELETE https://localhost:20128/api/settings/proxies \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/proxies/{id}/repair-relay
+
+POST settings › proxies › <id> › repair relay
+
+```bash
+curl -X POST https://localhost:20128/api/settings/proxies/{id}/repair-relay \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/proxies/assignments
+
+GET settings › proxies › assignments
+
+```bash
+curl https://localhost:20128/api/settings/proxies/assignments \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/settings/proxies/assignments
+
+PUT settings › proxies › assignments
+
+```bash
+curl -X PUT https://localhost:20128/api/settings/proxies/assignments \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/settings/proxies/auto-test
+
+POST settings › proxies › auto test
+
+```bash
+curl -X POST https://localhost:20128/api/settings/proxies/auto-test \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/settings/proxies/batch-activate
+
+POST settings › proxies › batch activate
+
+```bash
+curl -X POST https://localhost:20128/api/settings/proxies/batch-activate \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/settings/proxies/batch-delete
+
+POST settings › proxies › batch delete
+
+```bash
+curl -X POST https://localhost:20128/api/settings/proxies/batch-delete \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### PUT /api/settings/proxies/bulk-assign
+
+PUT settings › proxies › bulk assign
+
+```bash
+curl -X PUT https://localhost:20128/api/settings/proxies/bulk-assign \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/settings/proxies/bulk-import
+
+POST settings › proxies › bulk import
+
+```bash
+curl -X POST https://localhost:20128/api/settings/proxies/bulk-import \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/proxies/egress
+
+GET settings › proxies › egress
+
+```bash
+curl https://localhost:20128/api/settings/proxies/egress \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/proxies/egress
+
+POST settings › proxies › egress
+
+```bash
+curl -X POST https://localhost:20128/api/settings/proxies/egress \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/proxies/health
+
+GET settings › proxies › health
+
+```bash
+curl https://localhost:20128/api/settings/proxies/health \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/proxies/migrate
+
+POST settings › proxies › migrate
+
+```bash
+curl -X POST https://localhost:20128/api/settings/proxies/migrate \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/proxies/pool
+
+GET settings › proxies › pool
+
+```bash
+curl https://localhost:20128/api/settings/proxies/pool \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/settings/proxies/pool
+
+PUT settings › proxies › pool
+
+```bash
+curl -X PUT https://localhost:20128/api/settings/proxies/pool \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### PATCH /api/settings/proxies/pool
+
+PATCH settings › proxies › pool
+
+```bash
+curl -X PATCH https://localhost:20128/api/settings/proxies/pool \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/settings/proxies/pool
+
+DELETE settings › proxies › pool
+
+```bash
+curl -X DELETE https://localhost:20128/api/settings/proxies/pool \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/proxy/cloudflare-deploy
+
+POST settings › proxy › cloudflare deploy
+
+```bash
+curl -X POST https://localhost:20128/api/settings/proxy/cloudflare-deploy \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/settings/proxy/deno-deploy
+
+POST settings › proxy › deno deploy
+
+```bash
+curl -X POST https://localhost:20128/api/settings/proxy/deno-deploy \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/settings/proxy/vercel-deploy
+
+POST settings › proxy › vercel deploy
+
+```bash
+curl -X POST https://localhost:20128/api/settings/proxy/vercel-deploy \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/settings/purge-call-logs
+
+POST settings › purge call logs
+
+```bash
+curl -X POST https://localhost:20128/api/settings/purge-call-logs \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/settings/purge-detailed-logs
+
+POST settings › purge detailed logs
+
+```bash
+curl -X POST https://localhost:20128/api/settings/purge-detailed-logs \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/settings/purge-logs
+
+POST settings › purge logs
+
+```bash
+curl -X POST https://localhost:20128/api/settings/purge-logs \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/settings/purge-quota-snapshots
+
+POST settings › purge quota snapshots
+
+```bash
+curl -X POST https://localhost:20128/api/settings/purge-quota-snapshots \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/quota/state
+
+GET settings › quota › state
+
+```bash
+curl https://localhost:20128/api/settings/quota/state \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/quota/state
+
+POST settings › quota › state
+
+```bash
+curl -X POST https://localhost:20128/api/settings/quota/state \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/reasoning-routing-rules
+
+GET settings › reasoning routing rules
+
+```bash
+curl https://localhost:20128/api/settings/reasoning-routing-rules \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/reasoning-routing-rules
+
+POST settings › reasoning routing rules
+
+```bash
+curl -X POST https://localhost:20128/api/settings/reasoning-routing-rules \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/reasoning-routing-rules/{id}
+
+GET settings › reasoning routing rules › <id>
+
+```bash
+curl https://localhost:20128/api/settings/reasoning-routing-rules/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PATCH /api/settings/reasoning-routing-rules/{id}
+
+PATCH settings › reasoning routing rules › <id>
+
+```bash
+curl -X PATCH https://localhost:20128/api/settings/reasoning-routing-rules/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/settings/reasoning-routing-rules/{id}
+
+DELETE settings › reasoning routing rules › <id>
+
+```bash
+curl -X DELETE https://localhost:20128/api/settings/reasoning-routing-rules/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/reasoning-routing-rules/simulate
+
+POST settings › reasoning routing rules › simulate
+
+```bash
+curl -X POST https://localhost:20128/api/settings/reasoning-routing-rules/simulate \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/task-routing
+
+GET settings › task routing
+
+```bash
+curl https://localhost:20128/api/settings/task-routing \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/task-routing
+
+POST settings › task routing
+
+```bash
+curl -X POST https://localhost:20128/api/settings/task-routing \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### PUT /api/settings/task-routing
+
+PUT settings › task routing
+
+```bash
+curl -X PUT https://localhost:20128/api/settings/task-routing \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/tier-config
+
+GET settings › tier config
+
+```bash
+curl https://localhost:20128/api/settings/tier-config \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/settings/tier-config
+
+PUT settings › tier config
+
+```bash
+curl -X PUT https://localhost:20128/api/settings/tier-config \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
 ## Payloads
 
 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
diff --git a/skills/omni-sync-cloud/SKILL.md b/skills/omni-sync-cloud/SKILL.md
index 68c2d4a4a1..d44131977f 100644
--- a/skills/omni-sync-cloud/SKILL.md
+++ b/skills/omni-sync-cloud/SKILL.md
@@ -93,6 +93,44 @@ curl -X POST https://localhost:20128/api/sync/initialize \
   -d '{}'
 ```
 
+### GET /api/sync/bundle
+
+GET sync › bundle
+
+```bash
+curl https://localhost:20128/api/sync/bundle \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/sync/tokens
+
+GET sync › tokens
+
+```bash
+curl https://localhost:20128/api/sync/tokens \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/sync/tokens
+
+POST sync › tokens
+
+```bash
+curl -X POST https://localhost:20128/api/sync/tokens \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/sync/tokens/{id}
+
+DELETE sync › tokens › <id>
+
+```bash
+curl -X DELETE https://localhost:20128/api/sync/tokens/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
 ## Payloads
 
 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
diff --git a/skills/omni-usage-logs/SKILL.md b/skills/omni-usage-logs/SKILL.md
index af685e0e35..6a10e0e22a 100644
--- a/skills/omni-usage-logs/SKILL.md
+++ b/skills/omni-usage-logs/SKILL.md
@@ -137,6 +137,192 @@ curl https://localhost:20128/api/usage/model-latency-stats \
   -H "Authorization: Bearer $OMNIROUTE_TOKEN"
 ```
 
+### GET /api/usage/budget/bulk
+
+GET usage › budget › bulk
+
+```bash
+curl https://localhost:20128/api/usage/budget/bulk \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/usage/codex-reset-credit
+
+GET usage › codex reset credit
+
+```bash
+curl https://localhost:20128/api/usage/codex-reset-credit \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/usage/codex-reset-credit
+
+POST usage › codex reset credit
+
+```bash
+curl -X POST https://localhost:20128/api/usage/codex-reset-credit \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/usage/combo-forecast
+
+GET usage › combo forecast
+
+```bash
+curl https://localhost:20128/api/usage/combo-forecast \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/usage/combo-health
+
+GET usage › combo health
+
+```bash
+curl https://localhost:20128/api/usage/combo-health \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/usage/combo-health-autopilot
+
+GET usage › combo health autopilot
+
+```bash
+curl https://localhost:20128/api/usage/combo-health-autopilot \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/usage/combo-health-dashboard
+
+GET usage › combo health dashboard
+
+```bash
+curl https://localhost:20128/api/usage/combo-health-dashboard \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/usage/combo-scoring-inspector
+
+GET usage › combo scoring inspector
+
+```bash
+curl https://localhost:20128/api/usage/combo-scoring-inspector \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/usage/combo-trace/{id}
+
+GET usage › combo trace › <id>
+
+```bash
+curl https://localhost:20128/api/usage/combo-trace/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/usage/om-usage
+
+GET usage › om usage
+
+```bash
+curl https://localhost:20128/api/usage/om-usage \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/usage/provider-limits
+
+GET usage › provider limits
+
+```bash
+curl https://localhost:20128/api/usage/provider-limits \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/usage/provider-limits
+
+POST usage › provider limits
+
+```bash
+curl -X POST https://localhost:20128/api/usage/provider-limits \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/usage/provider-window-costs
+
+GET usage › provider window costs
+
+```bash
+curl https://localhost:20128/api/usage/provider-window-costs \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/usage/quota
+
+GET usage › quota
+
+```bash
+curl https://localhost:20128/api/usage/quota \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/usage/requests-by-provider-date
+
+GET usage › requests by provider date
+
+```bash
+curl https://localhost:20128/api/usage/requests-by-provider-date \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/usage/route-explain/{id}
+
+GET usage › route explain › <id>
+
+```bash
+curl https://localhost:20128/api/usage/route-explain/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/usage/token-limits
+
+GET usage › token limits
+
+```bash
+curl https://localhost:20128/api/usage/token-limits \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/usage/token-limits
+
+POST usage › token limits
+
+```bash
+curl -X POST https://localhost:20128/api/usage/token-limits \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/usage/token-limits
+
+DELETE usage › token limits
+
+```bash
+curl -X DELETE https://localhost:20128/api/usage/token-limits \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/usage/utilization
+
+GET usage › utilization
+
+```bash
+curl https://localhost:20128/api/usage/utilization \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
 ## Payloads
 
 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
diff --git a/skills/omni-version-manager/SKILL.md b/skills/omni-version-manager/SKILL.md
index eceda51dbc..5cfeca712c 100644
--- a/skills/omni-version-manager/SKILL.md
+++ b/skills/omni-version-manager/SKILL.md
@@ -620,6 +620,46 @@ curl https://localhost:20128/api/services/{name}/logs \
   -H "Authorization: Bearer $OMNIROUTE_TOKEN"
 ```
 
+### GET /api/services/9router/models
+
+GET services › 9router › models
+
+```bash
+curl https://localhost:20128/api/services/9router/models \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/services/9router/provider-expose
+
+POST services › 9router › provider expose
+
+```bash
+curl -X POST https://localhost:20128/api/services/9router/provider-expose \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/services/cliproxy/accounts
+
+GET services › cliproxy › accounts
+
+```bash
+curl https://localhost:20128/api/services/cliproxy/accounts \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/services/cliproxy/provider-expose
+
+POST services › cliproxy › provider expose
+
+```bash
+curl -X POST https://localhost:20128/api/services/cliproxy/provider-expose \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
 ## Payloads
 
 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
diff --git a/skills/omni-webhooks/SKILL.md b/skills/omni-webhooks/SKILL.md
index c60df46eca..8b1d137ad7 100644
--- a/skills/omni-webhooks/SKILL.md
+++ b/skills/omni-webhooks/SKILL.md
@@ -14,7 +14,86 @@ All requests require a valid Bearer token or session cookie. Obtain a token via
 
 ## Endpoints
 
-_No endpoints mapped for this area yet._
+### GET /api/webhooks
+
+GET webhooks
+
+```bash
+curl https://localhost:20128/api/webhooks \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/webhooks
+
+POST webhooks
+
+```bash
+curl -X POST https://localhost:20128/api/webhooks \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/webhooks/{id}
+
+GET webhooks › <id>
+
+```bash
+curl https://localhost:20128/api/webhooks/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/webhooks/{id}
+
+PUT webhooks › <id>
+
+```bash
+curl -X PUT https://localhost:20128/api/webhooks/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/webhooks/{id}
+
+DELETE webhooks › <id>
+
+```bash
+curl -X DELETE https://localhost:20128/api/webhooks/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/webhooks/{id}/deliveries
+
+GET webhooks › <id> › deliveries
+
+```bash
+curl https://localhost:20128/api/webhooks/{id}/deliveries \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/webhooks/{id}/test
+
+POST webhooks › <id> › test
+
+```bash
+curl -X POST https://localhost:20128/api/webhooks/{id}/test \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/webhooks/validate-url
+
+POST webhooks › validate url
+
+```bash
+curl -X POST https://localhost:20128/api/webhooks/validate-url \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
 ## Payloads
 
 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
diff --git a/tests/unit/openapi-security-tiers.test.ts b/tests/unit/openapi-security-tiers.test.ts
index e3b12804a6..8203ab6f2d 100644
--- a/tests/unit/openapi-security-tiers.test.ts
+++ b/tests/unit/openapi-security-tiers.test.ts
@@ -7,13 +7,13 @@ import * as yaml from "js-yaml";
 const ROOT = process.cwd();
 const OPENAPI_PATH = path.join(ROOT, "docs", "openapi.yaml");
 
-const { LOCAL_ONLY_API_PREFIXES, ALWAYS_PROTECTED_API_PATHS } =
+const { LOCAL_ONLY_API_PREFIXES, LOCAL_ONLY_API_PATTERNS, ALWAYS_PROTECTED_API_PATHS } =
   await import("../../src/server/authz/routeGuard.ts");
 
 const raw: any = yaml.load(fs.readFileSync(OPENAPI_PATH, "utf-8"));
 const paths: Record<string, any> = raw.paths || {};
 
-test("every x-loopback-only path matches a LOCAL_ONLY prefix in routeGuard.ts", () => {
+test("every x-loopback-only path matches a LOCAL_ONLY prefix or pattern in routeGuard.ts", () => {
   for (const [pathStr, methods] of Object.entries(paths)) {
     if (!methods || typeof methods !== "object") continue;
     for (const [method, spec] of Object.entries(methods as Record<string, any>)) {
@@ -25,10 +25,16 @@ test("every x-loopback-only path matches a LOCAL_ONLY prefix in routeGuard.ts",
           return pathStr === norm || pathStr.startsWith(norm + "/");
         }
       );
+      // Param-shaped routes (e.g. /api/providers/{id}/login) are classified by
+      // LOCAL_ONLY_API_PATTERNS regexes rather than a static prefix — the OpenAPI
+      // {param} placeholder satisfies the same [^/]+ segment the runtime matches.
+      const matchesPattern = (LOCAL_ONLY_API_PATTERNS as ReadonlyArray<RegExp>).some((re) =>
+        re.test(pathStr)
+      );
       assert.ok(
-        matchesPrefix,
-        `YAML path "${pathStr}" ${method.toUpperCase()} has x-loopback-only but is NOT in LOCAL_ONLY_API_PREFIXES. ` +
-          `Add it to routeGuard.ts LOCAL_ONLY_API_PREFIXES or remove x-loopback-only.`
+        matchesPrefix || matchesPattern,
+        `YAML path "${pathStr}" ${method.toUpperCase()} has x-loopback-only but is NOT in LOCAL_ONLY_API_PREFIXES ` +
+          `or LOCAL_ONLY_API_PATTERNS. Add it to routeGuard.ts or remove x-loopback-only.`
       );
     }
   }