docs(api): security tiers on generated paths, regenerated API skills, size baseline

The first CI round caught three real contract gaps in the generated coverage: - Generated operations on LOCAL_ONLY routes now carry x-loopback-only (and x-always-protected for ALWAYS_PROTECTED_API_PATHS), resolved through the real src/server/authz/routeGuard.ts at generation time. The openapi-security-tiers guard now also accepts LOCAL_ONLY_API_PATTERNS — param-shaped routes (/api/providers/{id}/login) are classified by regex in the runtime and were invisible to the prefix-only check. - The API agent skills are generated FROM the spec: 18 SKILL.md files regenerated via generate-agent-skills --apply so the generator stays 46/46. - src/app/docs/lib/openapi.generated.ts grew with the spec (171 -> 1347 lines, emitted by gen-openapi-module): frozen in file-size-baseline.json with a _rebaseline justification — shrink by slimming the spec, never by editing the generated module.
docs(api): document every implemented route in openapi.yaml (276 -> 692 paths)
2026-09-01 12:22:24 +03:00 · 2026-09-01 00:27:53 -03:00 · 2026-08-31 14:37:12 -03:00
23 changed files with 9762 additions and 14 deletions
--- a/config/quality/file-size-baseline.json
+++ b/config/quality/file-size-baseline.json
@@ -1,5 +1,6 @@
 {
  "_rebaseline_2026_08_20_10531_freebuff_provider": "PR #10531 (adrianaryaputra, feat/freebuff-provider-support, closes #6793) own growth: src/shared/constants/providers/apikey/gateways.ts 1283->1298 (+15, the freebuff APIKEY_PROVIDERS_GATEWAYS catalog entry, additive data at the existing registry chokepoint, same god-file no-split rationale as prior gateways.ts rebaselines) and src/app/(dashboard)/dashboard/providers/[id]/components/modals/AddApiKeyModal.tsx 1062->1067 (+5, freebuff credential placeholder/hint at the existing per-provider switch chokepoint). Covered by tests/unit/freebuff-provider.test.ts (9/9 passing).",
+  "_rebaseline_2026_08_31_12212_openapi_generated": "PR #12212 (docs audit follow-up nº 3): src/app/docs/lib/openapi.generated.ts 171->1347 — the module is emitted by scripts/docs/gen-openapi-module.mjs from docs/openapi.yaml, and the spec now documents all 692 implemented routes (was 276), so the generated output grew with the spec. Frozen at the generator output size; shrink by slimming the spec, never by hand-editing the generated module. Covered by tests/unit/openapi-security-tiers.test.ts (6/6) and the check:api-docs-refs gate (692/692 paths with a real route).",
  "_rebaseline_2026_08_21_10987_logfare_provider": "PR #10987 (jonlwheat2-gif, feat/10644-logfare-provider, closes #10644) own growth: src/shared/constants/providers/apikey/gateways.ts 1298->1321 (+23, the logfare APIKEY_PROVIDERS_GATEWAYS catalog entry with Free badge/freeNote/apiHint documenting the request-logging policy, additive data at the existing registry chokepoint, same god-file no-split rationale as the prior gateways.ts rebaselines: #10531 freebuff, merge-storm 2026-08-11). Covered by tests/unit/logfare-registry.test.ts (1/1 passing).",
  "_rebaseline_2026_08_20_10574_reasoning_transport_fallback": "PR #10574 (jackjinke, fix/responses-reasoning-transport, fixes #10550) own growth: src/sse/handlers/chatHelpers.ts 1017->1019 (+2 = the new reasoningTransportFallback option threaded through executeChatWithBreaker's options destructure and its downstream handleSingleModel call, at the existing per-attempt options-passthrough chokepoint; not extractable without splitting the option-forwarding call itself). Covered by the PR's own reasoning-policy test suite (tests/unit/chatcore-translation-paths.test.ts, tests/unit/combo-attempt-body-isolation-7847.test.ts, tests/unit/reasoning-cache.test.ts, tests/unit/strip-reasoning-blobs-agentic-context-1599.test.ts among others), 446/446 focused tests passing.",
  "_rebaseline_2026_08_18_10517_zed_hosted_oauth_callback_port": "PR #10517 (phatchau036, fix/zed-hosted-oauth-callback-port) own growth: src/shared/components/OAuthModal.tsx 1131->1148 (wc -l; check-file-size.mjs counts via split(\"\\n\").length so the gate sees 1134->1149, +15/+18, crosses the frozen 1134 cap). Wires the zed-hosted native-app callback auto-complete: forceManual gating on isTrueLocalhost for zed-hosted, the loopback-redirect-URI comment block, and the exchangeToken full-URL-as-code branch, all at the existing provider-switch chokepoints this modal already carries growth for (seventh bump: 969->989->993->998->1030->1056->1100->1149; structural shrink tracked in #3501). The actual port-derivation logic lives in src/lib/oauth/providers/zed-hosted.ts (not frozen here) and was hardened during pre-merge review to use the server's own getRuntimePorts() instead of a browser-guessed scheme/port, covered by the new tests/unit/zed-hosted-loopback-port-derivation.test.ts (8/8 passing).",
@@ -495,7 +496,8 @@
      "src/shared/components/ModelSelectModal.tsx": 1138,
      "src/shared/constants/providers/apikey/gateways.ts": 1250
    },
-    "open-sse/executors/commandCode.ts": 1271
+    "open-sse/executors/commandCode.ts": 1271,
+    "src/app/docs/lib/openapi.generated.ts": 1347
  },
  "_rebaseline_base_2026_08_10_proxyfetch": "Base-red fix (green-prs sweep, issue #9985): open-sse/utils/proxyFetch.ts 1207 > cap 1000 — new proxied-TLS fetch helper introduced by the Fal reference-image work. Owner-authorized quick rebaseline to green; structural slim tracked for v3.9.0.",
  "_rebaseline_2026_07_27_v3849_train2": "Merge-train 2 (7 PRs) — owner-approved 2026-07-27. Single entry: chatCore.ts 4955->5006 (#8595, Responses multi-turn image compaction before the context hard-reject). Genuine irreducible growth at the existing compaction chokepoint in handleChatCore — the PR adds a last-resort retry against the concrete budget plus the estimateFinalInputTokens helper, both wired at the pre-existing call site rather than a new branch. Covered by tests/unit/8560-responses-image-compaction.test.ts (4 tests).",
--- a/docs/openapi.yaml
+++ b/docs/openapi.yaml
--- a/scripts/ad-hoc/gen-openapi-missing-paths.mjs
+++ b/scripts/ad-hoc/gen-openapi-missing-paths.mjs
@@ -0,0 +1,129 @@
+#!/usr/bin/env node
+// One-shot generator (2026-08-31 docs audit follow-up nº 3): append a minimal,
+// honest OpenAPI entry for every real route that docs/openapi.yaml does not
+// document yet. Enumerates routes with the SAME lib the check:api-docs-refs
+// gate uses, so the generated set can never diverge from the gate's universe.
+// Minimal by design: real methods (parsed from each route.ts's exports), a
+// group tag, a neutral path-derived summary and a generic 200 — no invented
+// semantics. Rich schemas stay hand-curated in the existing entries.
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { collectApiRouteFiles, toApiUrlPath, apiRoot } from "../check/lib/apiRoutes.mjs";
+import { isLocalOnlyPath, ALWAYS_PROTECTED_API_PATHS } from "../../src/server/authz/routeGuard.ts";
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..");
+const SPEC = path.join(ROOT, "docs", "openapi.yaml");
+const APPLY = process.argv.includes("--apply");
+
+const normalizeParams = (p) => p.replace(/\{[^}]+\}/g, "{}");
+
+// --- real routes + their exported HTTP methods --------------------------------
+const METHOD_RE =
+  /export\s+(?:async\s+)?function\s+(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\b|export\s+const\s+(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\b|export\s*\{[^}]*\b(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\b[^}]*\}/g;
+
+function routeMethods(absFile) {
+  const src = fs.readFileSync(absFile, "utf8");
+  const methods = new Set();
+  for (const m of src.matchAll(METHOD_RE)) {
+    const name = m[1] || m[2];
+    if (name) methods.add(name);
+    if (m[3]) {
+      // re-export list: capture every method inside the braces
+      for (const inner of m[0].matchAll(/\b(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\b/g))
+        methods.add(inner[1]);
+    }
+  }
+  methods.delete("OPTIONS"); // CORS preflight — not a documented operation
+  methods.delete("HEAD");
+  return [...methods];
+}
+
+const routeFiles = collectApiRouteFiles(ROOT);
+const API_ROOT = apiRoot(ROOT);
+const routes = new Map(); // urlPath -> methods
+for (const rel of routeFiles) {
+  const abs = path.join(ROOT, rel);
+  const url = toApiUrlPath(path.dirname(abs), API_ROOT);
+  if (url) routes.set(url, routeMethods(abs));
+}
+
+// --- paths already in the spec -------------------------------------------------
+const spec = fs.readFileSync(SPEC, "utf8");
+const specPaths = new Set();
+for (const m of spec.matchAll(/^ {2}(\/[^\s:]+):\s*$/gm)) specPaths.add(normalizeParams(m[1]));
+
+const missing = [...routes.entries()]
+  .filter(([url]) => !specPaths.has(normalizeParams(url)))
+  .filter(([, methods]) => methods.length > 0)
+  .sort(([a], [b]) => a.localeCompare(b));
+
+// --- tag + summary derivation --------------------------------------------------
+const cap = (s) => s.charAt(0).toUpperCase() + s.slice(1);
+function groupTag(url) {
+  const seg = url.replace(/^\/api\//, "").split("/");
+  if (seg[0] === "v1") return seg[1] ? `V1 ${cap(seg[1].replace(/\{|\}/g, ""))}` : "V1";
+  return cap(seg[0].replace(/\{|\}/g, "").replace(/-/g, " "));
+}
+function summaryFor(url, method) {
+  const tail = url
+    .replace(/^\/api\/(v1\/)?/, "")
+    .replace(/\{([^}]+)\}/g, "<$1>")
+    .replace(/[/]/g, " › ")
+    .replace(/-/g, " ");
+  return `${method} ${tail}`;
+}
+
+// --- emit YAML -----------------------------------------------------------------
+const existingTags = new Set(
+  [...spec.matchAll(/^ {2}- name: (.+)$/gm)].map((m) => m[1].trim().toLowerCase())
+);
+const newTags = new Map();
+const lines = [];
+lines.push("");
+lines.push("  # --- Generated route coverage (docs audit 2026-08-31) -----------------------");
+lines.push("  # Minimal entries for every implemented route not documented above. Methods");
+lines.push("  # are parsed from each route.ts's exports; summaries are path-derived.");
+lines.push(
+  "  # Regenerate with: node --import tsx/esm scripts/ad-hoc/gen-openapi-missing-paths.mjs --apply"
+);
+for (const [url, methods] of missing) {
+  const tag = groupTag(url);
+  if (!existingTags.has(tag.toLowerCase()) && !newTags.has(tag))
+    newTags.set(tag, `${tag} endpoints (generated route coverage)`);
+  lines.push(`  ${url}:`);
+  const loopbackOnly = isLocalOnlyPath(url);
+  const alwaysProtected = ALWAYS_PROTECTED_API_PATHS.includes(url);
+  for (const method of methods.sort()) {
+    lines.push(`    ${method.toLowerCase()}:`);
+    lines.push(`      tags:`);
+    lines.push(`        - ${tag}`);
+    lines.push(`      summary: "${summaryFor(url, method)}"`);
+    if (loopbackOnly || isLocalOnlyPath(url, method)) lines.push(`      x-loopback-only: true`);
+    if (alwaysProtected) lines.push(`      x-always-protected: true`);
+    lines.push(`      responses:`);
+    lines.push(`        "200":`);
+    lines.push(`          description: OK`);
+  }
+}
+
+const tagLines = [...newTags.entries()]
+  .sort(([a], [b]) => a.localeCompare(b))
+  .map(([name, description]) => `  - name: ${name}\n    description: ${description}`)
+  .join("\n");
+
+console.log(
+  `real routes: ${routes.size} · already in spec: ${specPaths.size} · missing with methods: ${missing.length} · new tags: ${newTags.size}`
+);
+if (!APPLY) {
+  console.log("(dry-run) pass --apply to write docs/openapi.yaml");
+  process.exit(0);
+}
+
+let out = spec;
+// append new tags right after the last existing tag entry (before `paths:`)
+if (tagLines) out = out.replace(/\npaths:\n/, `\n${tagLines}\n\npaths:\n`);
+// insert generated paths right before the components section
+out = out.replace(/\ncomponents:\n/, `\n${lines.join("\n")}\n\ncomponents:\n`);
+fs.writeFileSync(SPEC, out);
+console.log(`wrote ${missing.length} paths + ${newTags.size} tags to docs/openapi.yaml`);
--- a/skills/omni-api-keys/SKILL.md
+++ b/skills/omni-api-keys/SKILL.md
@@ -74,6 +74,142 @@ curl https://localhost:20128/api/keys/{id}/devices \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
 ```

+### POST /api/keys/{id}/regenerate
+
+POST keys › <id> › regenerate
+
+```bash
+curl -X POST https://localhost:20128/api/keys/{id}/regenerate \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/keys/{id}/reveal
+
+GET keys › <id> › reveal
+
+```bash
+curl https://localhost:20128/api/keys/{id}/reveal \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/keys/{id}/usage-limits
+
+GET keys › <id> › usage limits
+
+```bash
+curl https://localhost:20128/api/keys/{id}/usage-limits \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/keys/groups
+
+GET keys › groups
+
+```bash
+curl https://localhost:20128/api/keys/groups \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/keys/groups
+
+POST keys › groups
+
+```bash
+curl -X POST https://localhost:20128/api/keys/groups \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/keys/groups/{id}
+
+GET keys › groups › <id>
+
+```bash
+curl https://localhost:20128/api/keys/groups/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/keys/groups/{id}
+
+PUT keys › groups › <id>
+
+```bash
+curl -X PUT https://localhost:20128/api/keys/groups/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/keys/groups/{id}
+
+DELETE keys › groups › <id>
+
+```bash
+curl -X DELETE https://localhost:20128/api/keys/groups/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/keys/groups/{id}/keys
+
+GET keys › groups › <id> › keys
+
+```bash
+curl https://localhost:20128/api/keys/groups/{id}/keys \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/keys/groups/{id}/keys
+
+POST keys › groups › <id> › keys
+
+```bash
+curl -X POST https://localhost:20128/api/keys/groups/{id}/keys \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/keys/groups/{id}/keys
+
+DELETE keys › groups › <id> › keys
+
+```bash
+curl -X DELETE https://localhost:20128/api/keys/groups/{id}/keys \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/keys/groups/{id}/permissions
+
+GET keys › groups › <id> › permissions
+
+```bash
+curl https://localhost:20128/api/keys/groups/{id}/permissions \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/keys/groups/{id}/permissions
+
+POST keys › groups › <id> › permissions
+
+```bash
+curl -X POST https://localhost:20128/api/keys/groups/{id}/permissions \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/keys/groups/{id}/permissions
+
+DELETE keys › groups › <id> › permissions
+
+```bash
+curl -X DELETE https://localhost:20128/api/keys/groups/{id}/permissions \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
 ## Payloads

 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
--- a/skills/omni-auth/SKILL.md
+++ b/skills/omni-auth/SKILL.md
@@ -69,6 +69,24 @@ curl https://localhost:20128/api/auth/oidc/callback \
  -b cookie.jar
 ```

+### GET /api/auth/csrf
+
+GET auth › csrf
+
+```bash
+curl https://localhost:20128/api/auth/csrf \
+  -b cookie.jar
+```
+
+### GET /api/auth/status
+
+GET auth › status
+
+```bash
+curl https://localhost:20128/api/auth/status \
+  -b cookie.jar
+```
+
 ## Payloads

 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
--- a/skills/omni-cache/SKILL.md
+++ b/skills/omni-cache/SKILL.md
@@ -52,6 +52,42 @@ curl -X DELETE https://localhost:20128/api/cache/stats \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
 ```

+### GET /api/cache/entries
+
+GET cache › entries
+
+```bash
+curl https://localhost:20128/api/cache/entries \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### DELETE /api/cache/entries
+
+DELETE cache › entries
+
+```bash
+curl -X DELETE https://localhost:20128/api/cache/entries \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cache/reasoning
+
+GET cache › reasoning
+
+```bash
+curl https://localhost:20128/api/cache/reasoning \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### DELETE /api/cache/reasoning
+
+DELETE cache › reasoning
+
+```bash
+curl -X DELETE https://localhost:20128/api/cache/reasoning \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
 ## Payloads

 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
--- a/skills/omni-cli-tools/SKILL.md
+++ b/skills/omni-cli-tools/SKILL.md
@@ -385,6 +385,372 @@ curl -X DELETE https://localhost:20128/api/cli-tools/codewhale-settings \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
 ```

+### GET /api/cli-tools/all-statuses
+
+GET cli tools › all statuses
+
+```bash
+curl https://localhost:20128/api/cli-tools/all-statuses \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/cli-tools/apply
+
+POST cli tools › apply
+
+```bash
+curl -X POST https://localhost:20128/api/cli-tools/apply \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/cli-tools/config
+
+GET cli tools › config
+
+```bash
+curl https://localhost:20128/api/cli-tools/config \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/cli-tools/config
+
+POST cli tools › config
+
+```bash
+curl -X POST https://localhost:20128/api/cli-tools/config \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/cli-tools/deepseek-tui-settings
+
+GET cli tools › deepseek tui settings
+
+```bash
+curl https://localhost:20128/api/cli-tools/deepseek-tui-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/cli-tools/deepseek-tui-settings
+
+POST cli tools › deepseek tui settings
+
+```bash
+curl -X POST https://localhost:20128/api/cli-tools/deepseek-tui-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/cli-tools/deepseek-tui-settings
+
+DELETE cli tools › deepseek tui settings
+
+```bash
+curl -X DELETE https://localhost:20128/api/cli-tools/deepseek-tui-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cli-tools/detect
+
+GET cli tools › detect
+
+```bash
+curl https://localhost:20128/api/cli-tools/detect \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cli-tools/forge-settings
+
+GET cli tools › forge settings
+
+```bash
+curl https://localhost:20128/api/cli-tools/forge-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/cli-tools/forge-settings
+
+POST cli tools › forge settings
+
+```bash
+curl -X POST https://localhost:20128/api/cli-tools/forge-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/cli-tools/forge-settings
+
+DELETE cli tools › forge settings
+
+```bash
+curl -X DELETE https://localhost:20128/api/cli-tools/forge-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cli-tools/grok-build-settings
+
+GET cli tools › grok build settings
+
+```bash
+curl https://localhost:20128/api/cli-tools/grok-build-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/cli-tools/grok-build-settings
+
+POST cli tools › grok build settings
+
+```bash
+curl -X POST https://localhost:20128/api/cli-tools/grok-build-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/cli-tools/grok-build-settings
+
+DELETE cli tools › grok build settings
+
+```bash
+curl -X DELETE https://localhost:20128/api/cli-tools/grok-build-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cli-tools/hermes-agent-settings
+
+GET cli tools › hermes agent settings
+
+```bash
+curl https://localhost:20128/api/cli-tools/hermes-agent-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/cli-tools/hermes-agent-settings
+
+POST cli tools › hermes agent settings
+
+```bash
+curl -X POST https://localhost:20128/api/cli-tools/hermes-agent-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/cli-tools/jcode-settings
+
+GET cli tools › jcode settings
+
+```bash
+curl https://localhost:20128/api/cli-tools/jcode-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/cli-tools/jcode-settings
+
+POST cli tools › jcode settings
+
+```bash
+curl -X POST https://localhost:20128/api/cli-tools/jcode-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/cli-tools/jcode-settings
+
+DELETE cli tools › jcode settings
+
+```bash
+curl -X DELETE https://localhost:20128/api/cli-tools/jcode-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cli-tools/keys
+
+GET cli tools › keys
+
+```bash
+curl https://localhost:20128/api/cli-tools/keys \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cli-tools/letta-settings
+
+GET cli tools › letta settings
+
+```bash
+curl https://localhost:20128/api/cli-tools/letta-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/cli-tools/letta-settings
+
+POST cli tools › letta settings
+
+```bash
+curl -X POST https://localhost:20128/api/cli-tools/letta-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/cli-tools/letta-settings
+
+DELETE cli tools › letta settings
+
+```bash
+curl -X DELETE https://localhost:20128/api/cli-tools/letta-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cli-tools/logs
+
+GET cli tools › logs
+
+```bash
+curl https://localhost:20128/api/cli-tools/logs \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cli-tools/omp-settings
+
+GET cli tools › omp settings
+
+```bash
+curl https://localhost:20128/api/cli-tools/omp-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/cli-tools/omp-settings
+
+POST cli tools › omp settings
+
+```bash
+curl -X POST https://localhost:20128/api/cli-tools/omp-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/cli-tools/omp-settings
+
+DELETE cli tools › omp settings
+
+```bash
+curl -X DELETE https://localhost:20128/api/cli-tools/omp-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cli-tools/openclaw/auto-order
+
+GET cli tools › openclaw › auto order
+
+```bash
+curl https://localhost:20128/api/cli-tools/openclaw/auto-order \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cli-tools/pi-settings
+
+GET cli tools › pi settings
+
+```bash
+curl https://localhost:20128/api/cli-tools/pi-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/cli-tools/pi-settings
+
+POST cli tools › pi settings
+
+```bash
+curl -X POST https://localhost:20128/api/cli-tools/pi-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/cli-tools/pi-settings
+
+DELETE cli tools › pi settings
+
+```bash
+curl -X DELETE https://localhost:20128/api/cli-tools/pi-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cli-tools/qwen-settings
+
+GET cli tools › qwen settings
+
+```bash
+curl https://localhost:20128/api/cli-tools/qwen-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/cli-tools/qwen-settings
+
+POST cli tools › qwen settings
+
+```bash
+curl -X POST https://localhost:20128/api/cli-tools/qwen-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/cli-tools/qwen-settings
+
+DELETE cli tools › qwen settings
+
+```bash
+curl -X DELETE https://localhost:20128/api/cli-tools/qwen-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cli-tools/smelt-settings
+
+GET cli tools › smelt settings
+
+```bash
+curl https://localhost:20128/api/cli-tools/smelt-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/cli-tools/smelt-settings
+
+POST cli tools › smelt settings
+
+```bash
+curl -X POST https://localhost:20128/api/cli-tools/smelt-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/cli-tools/smelt-settings
+
+DELETE cli tools › smelt settings
+
+```bash
+curl -X DELETE https://localhost:20128/api/cli-tools/smelt-settings \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/cli-tools/status
+
+GET cli tools › status
+
+```bash
+curl https://localhost:20128/api/cli-tools/status \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
 ## Payloads

 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
--- a/skills/omni-combos-routing/SKILL.md
+++ b/skills/omni-combos-routing/SKILL.md
@@ -131,6 +131,46 @@ curl -X DELETE https://localhost:20128/api/fallback/chains \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
 ```

+### GET /api/combos/auto
+
+GET combos › auto
+
+```bash
+curl https://localhost:20128/api/combos/auto \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/combos/builder/options
+
+GET combos › builder › options
+
+```bash
+curl https://localhost:20128/api/combos/builder/options \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/combos/duplicate
+
+POST combos › duplicate
+
+```bash
+curl -X POST https://localhost:20128/api/combos/duplicate \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/combos/reorder
+
+POST combos › reorder
+
+```bash
+curl -X POST https://localhost:20128/api/combos/reorder \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
 ## Payloads

 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
--- a/skills/omni-compression/SKILL.md
+++ b/skills/omni-compression/SKILL.md
@@ -43,6 +43,48 @@ curl https://localhost:20128/api/compression/rules \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
 ```

+### POST /api/compression/compare
+
+POST compression › compare
+
+```bash
+curl -X POST https://localhost:20128/api/compression/compare \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/compression/compare/verify
+
+POST compression › compare › verify
+
+```bash
+curl -X POST https://localhost:20128/api/compression/compare/verify \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/compression/engines
+
+GET compression › engines
+
+```bash
+curl https://localhost:20128/api/compression/engines \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/compression/retrieve
+
+POST compression › retrieve
+
+```bash
+curl -X POST https://localhost:20128/api/compression/retrieve \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
 ## Payloads

 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
--- a/skills/omni-context-rtk/SKILL.md
+++ b/skills/omni-context-rtk/SKILL.md
@@ -74,6 +74,24 @@ curl https://localhost:20128/api/context/rtk/raw-output/{id} \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
 ```

+### GET /api/context/rtk/discover
+
+GET context › rtk › discover
+
+```bash
+curl https://localhost:20128/api/context/rtk/discover \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/context/rtk/learn
+
+GET context › rtk › learn
+
+```bash
+curl https://localhost:20128/api/context/rtk/learn \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
 ## Payloads

 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
--- a/skills/omni-db-backups/SKILL.md
+++ b/skills/omni-db-backups/SKILL.md
@@ -14,7 +14,46 @@ All requests require a valid Bearer token or session cookie. Obtain a token via

 ## Endpoints

-_No endpoints mapped for this area yet._
+### GET /api/system/env/repair
+
+GET system › env › repair
+
+```bash
+curl https://localhost:20128/api/system/env/repair \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/system/env/repair
+
+POST system › env › repair
+
+```bash
+curl -X POST https://localhost:20128/api/system/env/repair \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/system/version
+
+GET system › version
+
+```bash
+curl https://localhost:20128/api/system/version \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/system/version
+
+POST system › version
+
+```bash
+curl -X POST https://localhost:20128/api/system/version \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
 ## Payloads

 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
--- a/skills/omni-inference/SKILL.md
+++ b/skills/omni-inference/SKILL.md
@@ -462,6 +462,898 @@ curl https://localhost:20128/api/v1/provider-plugin-manifest \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
 ```

+### GET /api/v1/{omnirouteCatchAll}
+
+GET <omnirouteCatchAll>
+
+```bash
+curl https://localhost:20128/api/v1/{omnirouteCatchAll} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/{omnirouteCatchAll}
+
+POST <omnirouteCatchAll>
+
+```bash
+curl -X POST https://localhost:20128/api/v1/{omnirouteCatchAll} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### PUT /api/v1/{omnirouteCatchAll}
+
+PUT <omnirouteCatchAll>
+
+```bash
+curl -X PUT https://localhost:20128/api/v1/{omnirouteCatchAll} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### PATCH /api/v1/{omnirouteCatchAll}
+
+PATCH <omnirouteCatchAll>
+
+```bash
+curl -X PATCH https://localhost:20128/api/v1/{omnirouteCatchAll} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/v1/{omnirouteCatchAll}
+
+DELETE <omnirouteCatchAll>
+
+```bash
+curl -X DELETE https://localhost:20128/api/v1/{omnirouteCatchAll} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/accounts/{id}/limits
+
+GET accounts › <id> › limits
+
+```bash
+curl https://localhost:20128/api/v1/accounts/{id}/limits \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/v1/accounts/{id}/limits
+
+PUT accounts › <id> › limits
+
+```bash
+curl -X PUT https://localhost:20128/api/v1/accounts/{id}/limits \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/agents/credentials
+
+GET agents › credentials
+
+```bash
+curl https://localhost:20128/api/v1/agents/credentials \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/agents/credentials
+
+POST agents › credentials
+
+```bash
+curl -X POST https://localhost:20128/api/v1/agents/credentials \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/agents/health
+
+GET agents › health
+
+```bash
+curl https://localhost:20128/api/v1/agents/health \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/agents/tasks
+
+GET agents › tasks
+
+```bash
+curl https://localhost:20128/api/v1/agents/tasks \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/agents/tasks
+
+POST agents › tasks
+
+```bash
+curl -X POST https://localhost:20128/api/v1/agents/tasks \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/v1/agents/tasks
+
+DELETE agents › tasks
+
+```bash
+curl -X DELETE https://localhost:20128/api/v1/agents/tasks \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/agents/tasks/{id}
+
+GET agents › tasks › <id>
+
+```bash
+curl https://localhost:20128/api/v1/agents/tasks/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/agents/tasks/{id}
+
+POST agents › tasks › <id>
+
+```bash
+curl -X POST https://localhost:20128/api/v1/agents/tasks/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/v1/agents/tasks/{id}
+
+DELETE agents › tasks › <id>
+
+```bash
+curl -X DELETE https://localhost:20128/api/v1/agents/tasks/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/antigravity
+
+POST antigravity
+
+```bash
+curl -X POST https://localhost:20128/api/v1/antigravity \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/auto-combo/{channel}/candidates
+
+GET auto combo › <channel> › candidates
+
+```bash
+curl https://localhost:20128/api/v1/auto-combo/{channel}/candidates \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/batches
+
+GET batches
+
+```bash
+curl https://localhost:20128/api/v1/batches \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/batches
+
+POST batches
+
+```bash
+curl -X POST https://localhost:20128/api/v1/batches \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/batches/{id}
+
+GET batches › <id>
+
+```bash
+curl https://localhost:20128/api/v1/batches/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### DELETE /api/v1/batches/{id}
+
+DELETE batches › <id>
+
+```bash
+curl -X DELETE https://localhost:20128/api/v1/batches/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/batches/{id}/cancel
+
+POST batches › <id> › cancel
+
+```bash
+curl -X POST https://localhost:20128/api/v1/batches/{id}/cancel \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/v1/batches/delete-completed
+
+DELETE batches › delete completed
+
+```bash
+curl -X DELETE https://localhost:20128/api/v1/batches/delete-completed \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/classify
+
+POST classify
+
+```bash
+curl -X POST https://localhost:20128/api/v1/classify \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/combos
+
+GET combos
+
+```bash
+curl https://localhost:20128/api/v1/combos \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/completions
+
+POST completions
+
+```bash
+curl -X POST https://localhost:20128/api/v1/completions \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/files
+
+GET files
+
+```bash
+curl https://localhost:20128/api/v1/files \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/files
+
+POST files
+
+```bash
+curl -X POST https://localhost:20128/api/v1/files \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/files/{id}
+
+GET files › <id>
+
+```bash
+curl https://localhost:20128/api/v1/files/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### DELETE /api/v1/files/{id}
+
+DELETE files › <id>
+
+```bash
+curl -X DELETE https://localhost:20128/api/v1/files/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/files/{id}/content
+
+GET files › <id> › content
+
+```bash
+curl https://localhost:20128/api/v1/files/{id}/content \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/images/edits
+
+POST images › edits
+
+```bash
+curl -X POST https://localhost:20128/api/v1/images/edits \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/images/upscale
+
+GET images › upscale
+
+```bash
+curl https://localhost:20128/api/v1/images/upscale \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/images/upscale
+
+POST images › upscale
+
+```bash
+curl -X POST https://localhost:20128/api/v1/images/upscale \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/v1/issues/report
+
+POST issues › report
+
+```bash
+curl -X POST https://localhost:20128/api/v1/issues/report \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/management/proxies
+
+GET management › proxies
+
+```bash
+curl https://localhost:20128/api/v1/management/proxies \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/management/proxies
+
+POST management › proxies
+
+```bash
+curl -X POST https://localhost:20128/api/v1/management/proxies \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### PATCH /api/v1/management/proxies
+
+PATCH management › proxies
+
+```bash
+curl -X PATCH https://localhost:20128/api/v1/management/proxies \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/v1/management/proxies
+
+DELETE management › proxies
+
+```bash
+curl -X DELETE https://localhost:20128/api/v1/management/proxies \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/management/proxies/assignments
+
+GET management › proxies › assignments
+
+```bash
+curl https://localhost:20128/api/v1/management/proxies/assignments \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/v1/management/proxies/assignments
+
+PUT management › proxies › assignments
+
+```bash
+curl -X PUT https://localhost:20128/api/v1/management/proxies/assignments \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### PUT /api/v1/management/proxies/bulk-assign
+
+PUT management › proxies › bulk assign
+
+```bash
+curl -X PUT https://localhost:20128/api/v1/management/proxies/bulk-assign \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/management/proxies/health
+
+GET management › proxies › health
+
+```bash
+curl https://localhost:20128/api/v1/management/proxies/health \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/me/status
+
+GET me › status
+
+```bash
+curl https://localhost:20128/api/v1/me/status \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/muse-code/models
+
+GET muse code › models
+
+```bash
+curl https://localhost:20128/api/v1/muse-code/models \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/music/generations
+
+GET music › generations
+
+```bash
+curl https://localhost:20128/api/v1/music/generations \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/music/generations
+
+POST music › generations
+
+```bash
+curl -X POST https://localhost:20128/api/v1/music/generations \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/providers/{provider}/limits
+
+GET providers › <provider> › limits
+
+```bash
+curl https://localhost:20128/api/v1/providers/{provider}/limits \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/v1/providers/{provider}/limits
+
+PUT providers › <provider> › limits
+
+```bash
+curl -X PUT https://localhost:20128/api/v1/providers/{provider}/limits \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/quotas/check
+
+GET quotas › check
+
+```bash
+curl https://localhost:20128/api/v1/quotas/check \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/registered-keys
+
+GET registered keys
+
+```bash
+curl https://localhost:20128/api/v1/registered-keys \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/registered-keys
+
+POST registered keys
+
+```bash
+curl -X POST https://localhost:20128/api/v1/registered-keys \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/registered-keys/{id}
+
+GET registered keys › <id>
+
+```bash
+curl https://localhost:20128/api/v1/registered-keys/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### DELETE /api/v1/registered-keys/{id}
+
+DELETE registered keys › <id>
+
+```bash
+curl -X DELETE https://localhost:20128/api/v1/registered-keys/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/registered-keys/{id}/revoke
+
+POST registered keys › <id> › revoke
+
+```bash
+curl -X POST https://localhost:20128/api/v1/registered-keys/{id}/revoke \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/v1/relay/chat/completions
+
+POST relay › chat › completions
+
+```bash
+curl -X POST https://localhost:20128/api/v1/relay/chat/completions \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/v1/relay/chat/completions/bifrost
+
+POST relay › chat › completions › bifrost
+
+```bash
+curl -X POST https://localhost:20128/api/v1/relay/chat/completions/bifrost \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/v1/responses/{path}
+
+POST responses › <path>
+
+```bash
+curl -X POST https://localhost:20128/api/v1/responses/{path} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/search/analytics
+
+GET search › analytics
+
+```bash
+curl https://localhost:20128/api/v1/search/analytics \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/segment
+
+POST segment
+
+```bash
+curl -X POST https://localhost:20128/api/v1/segment \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/video-bridge/drilldown
+
+GET video bridge › drilldown
+
+```bash
+curl https://localhost:20128/api/v1/video-bridge/drilldown \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### DELETE /api/v1/video-bridge/drilldown
+
+DELETE video bridge › drilldown
+
+```bash
+curl -X DELETE https://localhost:20128/api/v1/video-bridge/drilldown \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/videos/generations
+
+GET videos › generations
+
+```bash
+curl https://localhost:20128/api/v1/videos/generations \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/videos/generations
+
+POST videos › generations
+
+```bash
+curl -X POST https://localhost:20128/api/v1/videos/generations \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/vscode/{token}
+
+GET vscode › <token>
+
+```bash
+curl https://localhost:20128/api/v1/vscode/{token} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/vscode/{token}/api/chat
+
+POST vscode › <token> › api › chat
+
+```bash
+curl -X POST https://localhost:20128/api/v1/vscode/{token}/api/chat \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/v1/vscode/{token}/api/show
+
+POST vscode › <token> › api › show
+
+```bash
+curl -X POST https://localhost:20128/api/v1/vscode/{token}/api/show \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/vscode/{token}/api/tags
+
+GET vscode › <token> › api › tags
+
+```bash
+curl https://localhost:20128/api/v1/vscode/{token}/api/tags \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/vscode/{token}/api/version
+
+GET vscode › <token> › api › version
+
+```bash
+curl https://localhost:20128/api/v1/vscode/{token}/api/version \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/vscode/{token}/chat/completions
+
+POST vscode › <token> › chat › completions
+
+```bash
+curl -X POST https://localhost:20128/api/v1/vscode/{token}/chat/completions \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/vscode/{token}/combos
+
+GET vscode › <token> › combos
+
+```bash
+curl https://localhost:20128/api/v1/vscode/{token}/combos \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/vscode/{token}/models
+
+GET vscode › <token> › models
+
+```bash
+curl https://localhost:20128/api/v1/vscode/{token}/models \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/vscode/{token}/responses
+
+POST vscode › <token> › responses
+
+```bash
+curl -X POST https://localhost:20128/api/v1/vscode/{token}/responses \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/v1/vscode/{token}/v1/chat/completions
+
+POST vscode › <token> › v1 › chat › completions
+
+```bash
+curl -X POST https://localhost:20128/api/v1/vscode/{token}/v1/chat/completions \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/vscode/{token}/v1/models
+
+GET vscode › <token> › v1 › models
+
+```bash
+curl https://localhost:20128/api/v1/vscode/{token}/v1/models \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/vscode/combos/{token}/{{slug}}
+
+GET vscode › combos › <token> › <{slug>}
+
+```bash
+curl https://localhost:20128/api/v1/vscode/combos/{token}/{{slug}} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/vscode/combos/{token}/{{slug}}
+
+POST vscode › combos › <token> › <{slug>}
+
+```bash
+curl -X POST https://localhost:20128/api/v1/vscode/combos/{token}/{{slug}} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/vscode/raw/{token}
+
+GET vscode › raw › <token>
+
+```bash
+curl https://localhost:20128/api/v1/vscode/raw/{token} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/vscode/raw/{token}/api/chat
+
+POST vscode › raw › <token> › api › chat
+
+```bash
+curl -X POST https://localhost:20128/api/v1/vscode/raw/{token}/api/chat \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/v1/vscode/raw/{token}/api/show
+
+POST vscode › raw › <token> › api › show
+
+```bash
+curl -X POST https://localhost:20128/api/v1/vscode/raw/{token}/api/show \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/vscode/raw/{token}/api/tags
+
+GET vscode › raw › <token> › api › tags
+
+```bash
+curl https://localhost:20128/api/v1/vscode/raw/{token}/api/tags \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/vscode/raw/{token}/api/version
+
+GET vscode › raw › <token> › api › version
+
+```bash
+curl https://localhost:20128/api/v1/vscode/raw/{token}/api/version \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/vscode/raw/{token}/chat/completions
+
+POST vscode › raw › <token> › chat › completions
+
+```bash
+curl -X POST https://localhost:20128/api/v1/vscode/raw/{token}/chat/completions \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/vscode/raw/{token}/combos
+
+GET vscode › raw › <token> › combos
+
+```bash
+curl https://localhost:20128/api/v1/vscode/raw/{token}/combos \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/v1/vscode/raw/{token}/models
+
+GET vscode › raw › <token> › models
+
+```bash
+curl https://localhost:20128/api/v1/vscode/raw/{token}/models \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/vscode/raw/{token}/responses
+
+POST vscode › raw › <token> › responses
+
+```bash
+curl -X POST https://localhost:20128/api/v1/vscode/raw/{token}/responses \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/v1/vscode/raw/{token}/v1/chat/completions
+
+POST vscode › raw › <token> › v1 › chat › completions
+
+```bash
+curl -X POST https://localhost:20128/api/v1/vscode/raw/{token}/v1/chat/completions \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/vscode/raw/{token}/v1/models
+
+GET vscode › raw › <token> › v1 › models
+
+```bash
+curl https://localhost:20128/api/v1/vscode/raw/{token}/v1/models \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/v1/web/fetch
+
+POST web › fetch
+
+```bash
+curl -X POST https://localhost:20128/api/v1/web/fetch \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
 ## Payloads

 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
--- a/skills/omni-mcp/SKILL.md
+++ b/skills/omni-mcp/SKILL.md
@@ -14,7 +14,91 @@ All requests require a valid Bearer token or session cookie. Obtain a token via

 ## Endpoints

-_No endpoints mapped for this area yet._
+### GET /api/mcp/audit
+
+GET mcp › audit
+
+```bash
+curl https://localhost:20128/api/mcp/audit \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/mcp/audit/stats
+
+GET mcp › audit › stats
+
+```bash
+curl https://localhost:20128/api/mcp/audit/stats \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/mcp/sse
+
+GET mcp › sse
+
+```bash
+curl https://localhost:20128/api/mcp/sse \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/mcp/sse
+
+POST mcp › sse
+
+```bash
+curl -X POST https://localhost:20128/api/mcp/sse \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/mcp/status
+
+GET mcp › status
+
+```bash
+curl https://localhost:20128/api/mcp/status \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/mcp/stream
+
+GET mcp › stream
+
+```bash
+curl https://localhost:20128/api/mcp/stream \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/mcp/stream
+
+POST mcp › stream
+
+```bash
+curl -X POST https://localhost:20128/api/mcp/stream \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/mcp/stream
+
+DELETE mcp › stream
+
+```bash
+curl -X DELETE https://localhost:20128/api/mcp/stream \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/mcp/tools
+
+GET mcp › tools
+
+```bash
+curl https://localhost:20128/api/mcp/tools \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
 ## Payloads

 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
--- a/skills/omni-models/SKILL.md
+++ b/skills/omni-models/SKILL.md
@@ -54,6 +54,46 @@ curl https://localhost:20128/api/models/catalog \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
 ```

+### GET /api/models/openrouter-catalog
+
+GET models › openrouter catalog
+
+```bash
+curl https://localhost:20128/api/models/openrouter-catalog \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/models/test
+
+POST models › test
+
+```bash
+curl -X POST https://localhost:20128/api/models/test \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/models/test-all
+
+POST models › test all
+
+```bash
+curl -X POST https://localhost:20128/api/models/test-all \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/v1/models/{model}
+
+GET models › <model>
+
+```bash
+curl https://localhost:20128/api/v1/models/{model} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
 ## Payloads

 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
--- a/skills/omni-providers/SKILL.md
+++ b/skills/omni-providers/SKILL.md
@@ -229,6 +229,526 @@ curl https://localhost:20128/api/provider-models \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
 ```

+### GET /api/providers/{id}/cc-alias
+
+GET providers › <id> › cc alias
+
+```bash
+curl https://localhost:20128/api/providers/{id}/cc-alias \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/providers/{id}/cc-alias
+
+PUT providers › <id> › cc alias
+
+```bash
+curl -X PUT https://localhost:20128/api/providers/{id}/cc-alias \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/providers/{id}/chatgpt-web-codex-doctor
+
+GET providers › <id> › chatgpt web codex doctor
+
+```bash
+curl https://localhost:20128/api/providers/{id}/chatgpt-web-codex-doctor \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/providers/{id}/claude-auth/apply-local
+
+POST providers › <id> › claude auth › apply local
+
+```bash
+curl -X POST https://localhost:20128/api/providers/{id}/claude-auth/apply-local \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/{id}/claude-auth/export
+
+POST providers › <id> › claude auth › export
+
+```bash
+curl -X POST https://localhost:20128/api/providers/{id}/claude-auth/export \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/{id}/codex-auth/apply-local
+
+POST providers › <id> › codex auth › apply local
+
+```bash
+curl -X POST https://localhost:20128/api/providers/{id}/codex-auth/apply-local \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/{id}/codex-auth/export
+
+POST providers › <id> › codex auth › export
+
+```bash
+curl -X POST https://localhost:20128/api/providers/{id}/codex-auth/export \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/providers/{id}/interception-rules
+
+GET providers › <id> › interception rules
+
+```bash
+curl https://localhost:20128/api/providers/{id}/interception-rules \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/providers/{id}/interception-rules
+
+PUT providers › <id> › interception rules
+
+```bash
+curl -X PUT https://localhost:20128/api/providers/{id}/interception-rules \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/providers/{id}/interception-rules
+
+DELETE providers › <id> › interception rules
+
+```bash
+curl -X DELETE https://localhost:20128/api/providers/{id}/interception-rules \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/providers/{id}/login
+
+POST providers › <id> › login
+
+```bash
+curl -X POST https://localhost:20128/api/providers/{id}/login \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/providers/{id}/param-filters
+
+GET providers › <id> › param filters
+
+```bash
+curl https://localhost:20128/api/providers/{id}/param-filters \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/providers/{id}/param-filters
+
+PUT providers › <id> › param filters
+
+```bash
+curl -X PUT https://localhost:20128/api/providers/{id}/param-filters \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/providers/{id}/param-filters
+
+DELETE providers › <id> › param filters
+
+```bash
+curl -X DELETE https://localhost:20128/api/providers/{id}/param-filters \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/providers/{id}/refresh
+
+POST providers › <id> › refresh
+
+```bash
+curl -X POST https://localhost:20128/api/providers/{id}/refresh \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/{id}/refresh-cursor
+
+POST providers › <id> › refresh cursor
+
+```bash
+curl -X POST https://localhost:20128/api/providers/{id}/refresh-cursor \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/{id}/refresh-token
+
+POST providers › <id> › refresh token
+
+```bash
+curl -X POST https://localhost:20128/api/providers/{id}/refresh-token \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/{id}/sync-models
+
+POST providers › <id> › sync models
+
+```bash
+curl -X POST https://localhost:20128/api/providers/{id}/sync-models \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/bulk
+
+POST providers › bulk
+
+```bash
+curl -X POST https://localhost:20128/api/providers/bulk \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/bulk-web-session
+
+POST providers › bulk web session
+
+```bash
+curl -X POST https://localhost:20128/api/providers/bulk-web-session \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/claude-auth/import
+
+POST providers › claude auth › import
+
+```bash
+curl -X POST https://localhost:20128/api/providers/claude-auth/import \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/claude-auth/import-bulk
+
+POST providers › claude auth › import bulk
+
+```bash
+curl -X POST https://localhost:20128/api/providers/claude-auth/import-bulk \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/claude-auth/zip-extract
+
+POST providers › claude auth › zip extract
+
+```bash
+curl -X POST https://localhost:20128/api/providers/claude-auth/zip-extract \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/codex-auth/import
+
+POST providers › codex auth › import
+
+```bash
+curl -X POST https://localhost:20128/api/providers/codex-auth/import \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/codex-auth/import-bulk
+
+POST providers › codex auth › import bulk
+
+```bash
+curl -X POST https://localhost:20128/api/providers/codex-auth/import-bulk \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/codex-auth/zip-extract
+
+POST providers › codex auth › zip extract
+
+```bash
+curl -X POST https://localhost:20128/api/providers/codex-auth/zip-extract \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/command-code/auth/apply
+
+POST providers › command code › auth › apply
+
+```bash
+curl -X POST https://localhost:20128/api/providers/command-code/auth/apply \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/command-code/auth/callback
+
+POST providers › command code › auth › callback
+
+```bash
+curl -X POST https://localhost:20128/api/providers/command-code/auth/callback \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/command-code/auth/start
+
+POST providers › command code › auth › start
+
+```bash
+curl -X POST https://localhost:20128/api/providers/command-code/auth/start \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/providers/command-code/auth/status
+
+GET providers › command code › auth › status
+
+```bash
+curl https://localhost:20128/api/providers/command-code/auth/status \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/providers/command-code/auth/status
+
+POST providers › command code › auth › status
+
+```bash
+curl -X POST https://localhost:20128/api/providers/command-code/auth/status \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/providers/expiration
+
+GET providers › expiration
+
+```bash
+curl https://localhost:20128/api/providers/expiration \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/providers/free-onboarding
+
+GET providers › free onboarding
+
+```bash
+curl https://localhost:20128/api/providers/free-onboarding \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/providers/free-onboarding
+
+POST providers › free onboarding
+
+```bash
+curl -X POST https://localhost:20128/api/providers/free-onboarding \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/providers/health-autopilot
+
+GET providers › health autopilot
+
+```bash
+curl https://localhost:20128/api/providers/health-autopilot \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/providers/health-autopilot/actions
+
+POST providers › health autopilot › actions
+
+```bash
+curl -X POST https://localhost:20128/api/providers/health-autopilot/actions \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/providers/health-matrix
+
+GET providers › health matrix
+
+```bash
+curl https://localhost:20128/api/providers/health-matrix \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/providers/import
+
+POST providers › import
+
+```bash
+curl -X POST https://localhost:20128/api/providers/import \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/providers/openrouter-stats
+
+GET providers › openrouter stats
+
+```bash
+curl https://localhost:20128/api/providers/openrouter-stats \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/providers/quota-windows
+
+GET providers › quota windows
+
+```bash
+curl https://localhost:20128/api/providers/quota-windows \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/providers/volcengine-plan/connect
+
+POST providers › volcengine plan › connect
+
+```bash
+curl -X POST https://localhost:20128/api/providers/volcengine-plan/connect \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/volcengine-plan/connect/{sessionId}/cancel
+
+POST providers › volcengine plan › connect › <sessionId> › cancel
+
+```bash
+curl -X POST https://localhost:20128/api/providers/volcengine-plan/connect/{sessionId}/cancel \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/volcengine-plan/connect/{sessionId}/code
+
+POST providers › volcengine plan › connect › <sessionId> › code
+
+```bash
+curl -X POST https://localhost:20128/api/providers/volcengine-plan/connect/{sessionId}/code \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/volcengine-plan/connect/{sessionId}/identity
+
+POST providers › volcengine plan › connect › <sessionId> › identity
+
+```bash
+curl -X POST https://localhost:20128/api/providers/volcengine-plan/connect/{sessionId}/identity \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/volcengine-plan/connect/{sessionId}/resend
+
+POST providers › volcengine plan › connect › <sessionId> › resend
+
+```bash
+curl -X POST https://localhost:20128/api/providers/volcengine-plan/connect/{sessionId}/resend \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/providers/volcengine-plan/connect/{sessionId}/status
+
+GET providers › volcengine plan › connect › <sessionId> › status
+
+```bash
+curl https://localhost:20128/api/providers/volcengine-plan/connect/{sessionId}/status \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/providers/web-session-contract
+
+GET providers › web session contract
+
+```bash
+curl https://localhost:20128/api/providers/web-session-contract \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/providers/zed/discover
+
+POST providers › zed › discover
+
+```bash
+curl -X POST https://localhost:20128/api/providers/zed/discover \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/zed/import
+
+POST providers › zed › import
+
+```bash
+curl -X POST https://localhost:20128/api/providers/zed/import \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/providers/zed/manual-import
+
+POST providers › zed › manual import
+
+```bash
+curl -X POST https://localhost:20128/api/providers/zed/manual-import \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
 ## Payloads

 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
--- a/skills/omni-resilience/SKILL.md
+++ b/skills/omni-resilience/SKILL.md
@@ -25,6 +25,15 @@ curl https://localhost:20128/api/monitoring/health \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
 ```

+### GET /api/provider-metrics
+
+GET provider metrics
+
+```bash
+curl https://localhost:20128/api/provider-metrics \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
 ## Payloads

 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
--- a/skills/omni-settings/SKILL.md
+++ b/skills/omni-settings/SKILL.md
@@ -383,6 +383,981 @@ curl -X POST https://localhost:20128/api/settings/purge-usage-history \
  -d '{}'
 ```

+### GET /api/settings/authz-inventory
+
+GET settings › authz inventory
+
+```bash
+curl https://localhost:20128/api/settings/authz-inventory \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/auto-disable-accounts
+
+GET settings › auto disable accounts
+
+```bash
+curl https://localhost:20128/api/settings/auto-disable-accounts \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/settings/auto-disable-accounts
+
+PUT settings › auto disable accounts
+
+```bash
+curl -X PUT https://localhost:20128/api/settings/auto-disable-accounts \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/background-degradation
+
+GET settings › background degradation
+
+```bash
+curl https://localhost:20128/api/settings/background-degradation \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/background-degradation
+
+POST settings › background degradation
+
+```bash
+curl -X POST https://localhost:20128/api/settings/background-degradation \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### PUT /api/settings/background-degradation
+
+PUT settings › background degradation
+
+```bash
+curl -X PUT https://localhost:20128/api/settings/background-degradation \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/cache-config
+
+GET settings › cache config
+
+```bash
+curl https://localhost:20128/api/settings/cache-config \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/settings/cache-config
+
+PUT settings › cache config
+
+```bash
+curl -X PUT https://localhost:20128/api/settings/cache-config \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/cache-metrics
+
+GET settings › cache metrics
+
+```bash
+curl https://localhost:20128/api/settings/cache-metrics \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### DELETE /api/settings/cache-metrics
+
+DELETE settings › cache metrics
+
+```bash
+curl -X DELETE https://localhost:20128/api/settings/cache-metrics \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/cc-discovery-metrics
+
+GET settings › cc discovery metrics
+
+```bash
+curl https://localhost:20128/api/settings/cc-discovery-metrics \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/compression/rules
+
+GET settings › compression › rules
+
+```bash
+curl https://localhost:20128/api/settings/compression/rules \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/compression/run-telemetry
+
+GET settings › compression › run telemetry
+
+```bash
+curl https://localhost:20128/api/settings/compression/run-telemetry \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/database
+
+GET settings › database
+
+```bash
+curl https://localhost:20128/api/settings/database \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/settings/database
+
+PUT settings › database
+
+```bash
+curl -X PUT https://localhost:20128/api/settings/database \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### PATCH /api/settings/database
+
+PATCH settings › database
+
+```bash
+curl -X PATCH https://localhost:20128/api/settings/database \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/settings/database/refresh-stats
+
+POST settings › database › refresh stats
+
+```bash
+curl -X POST https://localhost:20128/api/settings/database/refresh-stats \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/database/vacuum
+
+GET settings › database › vacuum
+
+```bash
+curl https://localhost:20128/api/settings/database/vacuum \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/database/vacuum
+
+POST settings › database › vacuum
+
+```bash
+curl -X POST https://localhost:20128/api/settings/database/vacuum \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/export-json
+
+GET settings › export json
+
+```bash
+curl https://localhost:20128/api/settings/export-json \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/favicon
+
+GET settings › favicon
+
+```bash
+curl https://localhost:20128/api/settings/favicon \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/feature-flags
+
+GET settings › feature flags
+
+```bash
+curl https://localhost:20128/api/settings/feature-flags \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/settings/feature-flags
+
+PUT settings › feature flags
+
+```bash
+curl -X PUT https://localhost:20128/api/settings/feature-flags \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/settings/feature-flags
+
+DELETE settings › feature flags
+
+```bash
+curl -X DELETE https://localhost:20128/api/settings/feature-flags \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/free-proxies
+
+GET settings › free proxies
+
+```bash
+curl https://localhost:20128/api/settings/free-proxies \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### DELETE /api/settings/free-proxies
+
+DELETE settings › free proxies
+
+```bash
+curl -X DELETE https://localhost:20128/api/settings/free-proxies \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/free-proxies/{id}/add-to-pool
+
+POST settings › free proxies › <id> › add to pool
+
+```bash
+curl -X POST https://localhost:20128/api/settings/free-proxies/{id}/add-to-pool \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/settings/free-proxies/bulk-add-to-pool
+
+POST settings › free proxies › bulk add to pool
+
+```bash
+curl -X POST https://localhost:20128/api/settings/free-proxies/bulk-add-to-pool \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/free-proxies/stats
+
+GET settings › free proxies › stats
+
+```bash
+curl https://localhost:20128/api/settings/free-proxies/stats \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/free-proxies/sync
+
+POST settings › free proxies › sync
+
+```bash
+curl -X POST https://localhost:20128/api/settings/free-proxies/sync \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/settings/import-json
+
+POST settings › import json
+
+```bash
+curl -X POST https://localhost:20128/api/settings/import-json \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/settings/lkgp-cache
+
+DELETE settings › lkgp cache
+
+```bash
+curl -X DELETE https://localhost:20128/api/settings/lkgp-cache \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/local-corpus
+
+GET settings › local corpus
+
+```bash
+curl https://localhost:20128/api/settings/local-corpus \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/local-corpus
+
+POST settings › local corpus
+
+```bash
+curl -X POST https://localhost:20128/api/settings/local-corpus \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/settings/local-corpus
+
+DELETE settings › local corpus
+
+```bash
+curl -X DELETE https://localhost:20128/api/settings/local-corpus \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/mitm
+
+GET settings › mitm
+
+```bash
+curl https://localhost:20128/api/settings/mitm \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/mitm
+
+POST settings › mitm
+
+```bash
+curl -X POST https://localhost:20128/api/settings/mitm \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### PUT /api/settings/mitm
+
+PUT settings › mitm
+
+```bash
+curl -X PUT https://localhost:20128/api/settings/mitm \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/model-aliases
+
+GET settings › model aliases
+
+```bash
+curl https://localhost:20128/api/settings/model-aliases \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/model-aliases
+
+POST settings › model aliases
+
+```bash
+curl -X POST https://localhost:20128/api/settings/model-aliases \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### PUT /api/settings/model-aliases
+
+PUT settings › model aliases
+
+```bash
+curl -X PUT https://localhost:20128/api/settings/model-aliases \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/settings/model-aliases
+
+DELETE settings › model aliases
+
+```bash
+curl -X DELETE https://localhost:20128/api/settings/model-aliases \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/models-dev
+
+GET settings › models dev
+
+```bash
+curl https://localhost:20128/api/settings/models-dev \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/models-dev
+
+POST settings › models dev
+
+```bash
+curl -X POST https://localhost:20128/api/settings/models-dev \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/notion
+
+GET settings › notion
+
+```bash
+curl https://localhost:20128/api/settings/notion \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/notion
+
+POST settings › notion
+
+```bash
+curl -X POST https://localhost:20128/api/settings/notion \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/settings/notion
+
+DELETE settings › notion
+
+```bash
+curl -X DELETE https://localhost:20128/api/settings/notion \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/obsidian
+
+GET settings › obsidian
+
+```bash
+curl https://localhost:20128/api/settings/obsidian \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/obsidian
+
+POST settings › obsidian
+
+```bash
+curl -X POST https://localhost:20128/api/settings/obsidian \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/settings/obsidian
+
+DELETE settings › obsidian
+
+```bash
+curl -X DELETE https://localhost:20128/api/settings/obsidian \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/obsidian/webdav
+
+GET settings › obsidian › webdav
+
+```bash
+curl https://localhost:20128/api/settings/obsidian/webdav \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/obsidian/webdav
+
+POST settings › obsidian › webdav
+
+```bash
+curl -X POST https://localhost:20128/api/settings/obsidian/webdav \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/settings/obsidian/webdav
+
+DELETE settings › obsidian › webdav
+
+```bash
+curl -X DELETE https://localhost:20128/api/settings/obsidian/webdav \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/settings/oneproxy
+
+GET settings › oneproxy
+
+```bash
+curl https://localhost:20128/api/settings/oneproxy \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/oneproxy
+
+POST settings › oneproxy
+
+```bash
+curl -X POST https://localhost:20128/api/settings/oneproxy \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/settings/oneproxy
+
+DELETE settings › oneproxy
+
+```bash
+curl -X DELETE https://localhost:20128/api/settings/oneproxy \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/oneproxy/rotate
+
+POST settings › oneproxy › rotate
+
+```bash
+curl -X POST https://localhost:20128/api/settings/oneproxy/rotate \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/proxies
+
+GET settings › proxies
+
+```bash
+curl https://localhost:20128/api/settings/proxies \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/proxies
+
+POST settings › proxies
+
+```bash
+curl -X POST https://localhost:20128/api/settings/proxies \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### PATCH /api/settings/proxies
+
+PATCH settings › proxies
+
+```bash
+curl -X PATCH https://localhost:20128/api/settings/proxies \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/settings/proxies
+
+DELETE settings › proxies
+
+```bash
+curl -X DELETE https://localhost:20128/api/settings/proxies \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/proxies/{id}/repair-relay
+
+POST settings › proxies › <id> › repair relay
+
+```bash
+curl -X POST https://localhost:20128/api/settings/proxies/{id}/repair-relay \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/proxies/assignments
+
+GET settings › proxies › assignments
+
+```bash
+curl https://localhost:20128/api/settings/proxies/assignments \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/settings/proxies/assignments
+
+PUT settings › proxies › assignments
+
+```bash
+curl -X PUT https://localhost:20128/api/settings/proxies/assignments \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/settings/proxies/auto-test
+
+POST settings › proxies › auto test
+
+```bash
+curl -X POST https://localhost:20128/api/settings/proxies/auto-test \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/settings/proxies/batch-activate
+
+POST settings › proxies › batch activate
+
+```bash
+curl -X POST https://localhost:20128/api/settings/proxies/batch-activate \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/settings/proxies/batch-delete
+
+POST settings › proxies › batch delete
+
+```bash
+curl -X POST https://localhost:20128/api/settings/proxies/batch-delete \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### PUT /api/settings/proxies/bulk-assign
+
+PUT settings › proxies › bulk assign
+
+```bash
+curl -X PUT https://localhost:20128/api/settings/proxies/bulk-assign \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/settings/proxies/bulk-import
+
+POST settings › proxies › bulk import
+
+```bash
+curl -X POST https://localhost:20128/api/settings/proxies/bulk-import \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/proxies/egress
+
+GET settings › proxies › egress
+
+```bash
+curl https://localhost:20128/api/settings/proxies/egress \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/proxies/egress
+
+POST settings › proxies › egress
+
+```bash
+curl -X POST https://localhost:20128/api/settings/proxies/egress \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/proxies/health
+
+GET settings › proxies › health
+
+```bash
+curl https://localhost:20128/api/settings/proxies/health \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/proxies/migrate
+
+POST settings › proxies › migrate
+
+```bash
+curl -X POST https://localhost:20128/api/settings/proxies/migrate \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/proxies/pool
+
+GET settings › proxies › pool
+
+```bash
+curl https://localhost:20128/api/settings/proxies/pool \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/settings/proxies/pool
+
+PUT settings › proxies › pool
+
+```bash
+curl -X PUT https://localhost:20128/api/settings/proxies/pool \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### PATCH /api/settings/proxies/pool
+
+PATCH settings › proxies › pool
+
+```bash
+curl -X PATCH https://localhost:20128/api/settings/proxies/pool \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/settings/proxies/pool
+
+DELETE settings › proxies › pool
+
+```bash
+curl -X DELETE https://localhost:20128/api/settings/proxies/pool \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/proxy/cloudflare-deploy
+
+POST settings › proxy › cloudflare deploy
+
+```bash
+curl -X POST https://localhost:20128/api/settings/proxy/cloudflare-deploy \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/settings/proxy/deno-deploy
+
+POST settings › proxy › deno deploy
+
+```bash
+curl -X POST https://localhost:20128/api/settings/proxy/deno-deploy \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/settings/proxy/vercel-deploy
+
+POST settings › proxy › vercel deploy
+
+```bash
+curl -X POST https://localhost:20128/api/settings/proxy/vercel-deploy \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/settings/purge-call-logs
+
+POST settings › purge call logs
+
+```bash
+curl -X POST https://localhost:20128/api/settings/purge-call-logs \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/settings/purge-detailed-logs
+
+POST settings › purge detailed logs
+
+```bash
+curl -X POST https://localhost:20128/api/settings/purge-detailed-logs \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/settings/purge-logs
+
+POST settings › purge logs
+
+```bash
+curl -X POST https://localhost:20128/api/settings/purge-logs \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/settings/purge-quota-snapshots
+
+POST settings › purge quota snapshots
+
+```bash
+curl -X POST https://localhost:20128/api/settings/purge-quota-snapshots \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/quota/state
+
+GET settings › quota › state
+
+```bash
+curl https://localhost:20128/api/settings/quota/state \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/quota/state
+
+POST settings › quota › state
+
+```bash
+curl -X POST https://localhost:20128/api/settings/quota/state \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/reasoning-routing-rules
+
+GET settings › reasoning routing rules
+
+```bash
+curl https://localhost:20128/api/settings/reasoning-routing-rules \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/reasoning-routing-rules
+
+POST settings › reasoning routing rules
+
+```bash
+curl -X POST https://localhost:20128/api/settings/reasoning-routing-rules \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/reasoning-routing-rules/{id}
+
+GET settings › reasoning routing rules › <id>
+
+```bash
+curl https://localhost:20128/api/settings/reasoning-routing-rules/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PATCH /api/settings/reasoning-routing-rules/{id}
+
+PATCH settings › reasoning routing rules › <id>
+
+```bash
+curl -X PATCH https://localhost:20128/api/settings/reasoning-routing-rules/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/settings/reasoning-routing-rules/{id}
+
+DELETE settings › reasoning routing rules › <id>
+
+```bash
+curl -X DELETE https://localhost:20128/api/settings/reasoning-routing-rules/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/reasoning-routing-rules/simulate
+
+POST settings › reasoning routing rules › simulate
+
+```bash
+curl -X POST https://localhost:20128/api/settings/reasoning-routing-rules/simulate \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/task-routing
+
+GET settings › task routing
+
+```bash
+curl https://localhost:20128/api/settings/task-routing \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/settings/task-routing
+
+POST settings › task routing
+
+```bash
+curl -X POST https://localhost:20128/api/settings/task-routing \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### PUT /api/settings/task-routing
+
+PUT settings › task routing
+
+```bash
+curl -X PUT https://localhost:20128/api/settings/task-routing \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/settings/tier-config
+
+GET settings › tier config
+
+```bash
+curl https://localhost:20128/api/settings/tier-config \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/settings/tier-config
+
+PUT settings › tier config
+
+```bash
+curl -X PUT https://localhost:20128/api/settings/tier-config \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
 ## Payloads

 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
--- a/skills/omni-sync-cloud/SKILL.md
+++ b/skills/omni-sync-cloud/SKILL.md
@@ -93,6 +93,44 @@ curl -X POST https://localhost:20128/api/sync/initialize \
  -d '{}'
 ```

+### GET /api/sync/bundle
+
+GET sync › bundle
+
+```bash
+curl https://localhost:20128/api/sync/bundle \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/sync/tokens
+
+GET sync › tokens
+
+```bash
+curl https://localhost:20128/api/sync/tokens \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/sync/tokens
+
+POST sync › tokens
+
+```bash
+curl -X POST https://localhost:20128/api/sync/tokens \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/sync/tokens/{id}
+
+DELETE sync › tokens › <id>
+
+```bash
+curl -X DELETE https://localhost:20128/api/sync/tokens/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
 ## Payloads

 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
--- a/skills/omni-usage-logs/SKILL.md
+++ b/skills/omni-usage-logs/SKILL.md
@@ -137,6 +137,192 @@ curl https://localhost:20128/api/usage/model-latency-stats \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
 ```

+### GET /api/usage/budget/bulk
+
+GET usage › budget › bulk
+
+```bash
+curl https://localhost:20128/api/usage/budget/bulk \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/usage/codex-reset-credit
+
+GET usage › codex reset credit
+
+```bash
+curl https://localhost:20128/api/usage/codex-reset-credit \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/usage/codex-reset-credit
+
+POST usage › codex reset credit
+
+```bash
+curl -X POST https://localhost:20128/api/usage/codex-reset-credit \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/usage/combo-forecast
+
+GET usage › combo forecast
+
+```bash
+curl https://localhost:20128/api/usage/combo-forecast \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/usage/combo-health
+
+GET usage › combo health
+
+```bash
+curl https://localhost:20128/api/usage/combo-health \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/usage/combo-health-autopilot
+
+GET usage › combo health autopilot
+
+```bash
+curl https://localhost:20128/api/usage/combo-health-autopilot \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/usage/combo-health-dashboard
+
+GET usage › combo health dashboard
+
+```bash
+curl https://localhost:20128/api/usage/combo-health-dashboard \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/usage/combo-scoring-inspector
+
+GET usage › combo scoring inspector
+
+```bash
+curl https://localhost:20128/api/usage/combo-scoring-inspector \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/usage/combo-trace/{id}
+
+GET usage › combo trace › <id>
+
+```bash
+curl https://localhost:20128/api/usage/combo-trace/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/usage/om-usage
+
+GET usage › om usage
+
+```bash
+curl https://localhost:20128/api/usage/om-usage \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/usage/provider-limits
+
+GET usage › provider limits
+
+```bash
+curl https://localhost:20128/api/usage/provider-limits \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/usage/provider-limits
+
+POST usage › provider limits
+
+```bash
+curl -X POST https://localhost:20128/api/usage/provider-limits \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/usage/provider-window-costs
+
+GET usage › provider window costs
+
+```bash
+curl https://localhost:20128/api/usage/provider-window-costs \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/usage/quota
+
+GET usage › quota
+
+```bash
+curl https://localhost:20128/api/usage/quota \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/usage/requests-by-provider-date
+
+GET usage › requests by provider date
+
+```bash
+curl https://localhost:20128/api/usage/requests-by-provider-date \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/usage/route-explain/{id}
+
+GET usage › route explain › <id>
+
+```bash
+curl https://localhost:20128/api/usage/route-explain/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/usage/token-limits
+
+GET usage › token limits
+
+```bash
+curl https://localhost:20128/api/usage/token-limits \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/usage/token-limits
+
+POST usage › token limits
+
+```bash
+curl -X POST https://localhost:20128/api/usage/token-limits \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/usage/token-limits
+
+DELETE usage › token limits
+
+```bash
+curl -X DELETE https://localhost:20128/api/usage/token-limits \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/usage/utilization
+
+GET usage › utilization
+
+```bash
+curl https://localhost:20128/api/usage/utilization \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
 ## Payloads

 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
--- a/skills/omni-version-manager/SKILL.md
+++ b/skills/omni-version-manager/SKILL.md
@@ -620,6 +620,46 @@ curl https://localhost:20128/api/services/{name}/logs \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
 ```

+### GET /api/services/9router/models
+
+GET services › 9router › models
+
+```bash
+curl https://localhost:20128/api/services/9router/models \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/services/9router/provider-expose
+
+POST services › 9router › provider expose
+
+```bash
+curl -X POST https://localhost:20128/api/services/9router/provider-expose \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/services/cliproxy/accounts
+
+GET services › cliproxy › accounts
+
+```bash
+curl https://localhost:20128/api/services/cliproxy/accounts \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/services/cliproxy/provider-expose
+
+POST services › cliproxy › provider expose
+
+```bash
+curl -X POST https://localhost:20128/api/services/cliproxy/provider-expose \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
 ## Payloads

 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
--- a/skills/omni-webhooks/SKILL.md
+++ b/skills/omni-webhooks/SKILL.md
@@ -14,7 +14,86 @@ All requests require a valid Bearer token or session cookie. Obtain a token via

 ## Endpoints

-_No endpoints mapped for this area yet._
+### GET /api/webhooks
+
+GET webhooks
+
+```bash
+curl https://localhost:20128/api/webhooks \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/webhooks
+
+POST webhooks
+
+```bash
+curl -X POST https://localhost:20128/api/webhooks \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### GET /api/webhooks/{id}
+
+GET webhooks › <id>
+
+```bash
+curl https://localhost:20128/api/webhooks/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### PUT /api/webhooks/{id}
+
+PUT webhooks › <id>
+
+```bash
+curl -X PUT https://localhost:20128/api/webhooks/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### DELETE /api/webhooks/{id}
+
+DELETE webhooks › <id>
+
+```bash
+curl -X DELETE https://localhost:20128/api/webhooks/{id} \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### GET /api/webhooks/{id}/deliveries
+
+GET webhooks › <id> › deliveries
+
+```bash
+curl https://localhost:20128/api/webhooks/{id}/deliveries \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
+### POST /api/webhooks/{id}/test
+
+POST webhooks › <id> › test
+
+```bash
+curl -X POST https://localhost:20128/api/webhooks/{id}/test \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
+### POST /api/webhooks/validate-url
+
+POST webhooks › validate url
+
+```bash
+curl -X POST https://localhost:20128/api/webhooks/validate-url \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{}'
+```
+
 ## Payloads

 See the full OpenAPI specification at `GET /api/openapi/spec` or `docs/openapi.yaml` for detailed request/response schemas.
--- a/src/app/docs/lib/openapi.generated.ts
+++ b/src/app/docs/lib/openapi.generated.ts
--- a/tests/unit/openapi-security-tiers.test.ts
+++ b/tests/unit/openapi-security-tiers.test.ts
@@ -7,13 +7,13 @@ import * as yaml from "js-yaml";
 const ROOT = process.cwd();
 const OPENAPI_PATH = path.join(ROOT, "docs", "openapi.yaml");

-const { LOCAL_ONLY_API_PREFIXES, ALWAYS_PROTECTED_API_PATHS } =
+const { LOCAL_ONLY_API_PREFIXES, LOCAL_ONLY_API_PATTERNS, ALWAYS_PROTECTED_API_PATHS } =
  await import("../../src/server/authz/routeGuard.ts");

 const raw: any = yaml.load(fs.readFileSync(OPENAPI_PATH, "utf-8"));
 const paths: Record<string, any> = raw.paths || {};

-test("every x-loopback-only path matches a LOCAL_ONLY prefix in routeGuard.ts", () => {
+test("every x-loopback-only path matches a LOCAL_ONLY prefix or pattern in routeGuard.ts", () => {
  for (const [pathStr, methods] of Object.entries(paths)) {
    if (!methods || typeof methods !== "object") continue;
    for (const [method, spec] of Object.entries(methods as Record<string, any>)) {
@@ -25,10 +25,16 @@ test("every x-loopback-only path matches a LOCAL_ONLY prefix in routeGuard.ts",
          return pathStr === norm || pathStr.startsWith(norm + "/");
        }
      );
+      // Param-shaped routes (e.g. /api/providers/{id}/login) are classified by
+      // LOCAL_ONLY_API_PATTERNS regexes rather than a static prefix — the OpenAPI
+      // {param} placeholder satisfies the same [^/]+ segment the runtime matches.
+      const matchesPattern = (LOCAL_ONLY_API_PATTERNS as ReadonlyArray<RegExp>).some((re) =>
+        re.test(pathStr)
+      );
      assert.ok(
-        matchesPrefix,
-        `YAML path "${pathStr}" ${method.toUpperCase()} has x-loopback-only but is NOT in LOCAL_ONLY_API_PREFIXES. ` +
-          `Add it to routeGuard.ts LOCAL_ONLY_API_PREFIXES or remove x-loopback-only.`
+        matchesPrefix || matchesPattern,
+        `YAML path "${pathStr}" ${method.toUpperCase()} has x-loopback-only but is NOT in LOCAL_ONLY_API_PREFIXES ` +
+          `or LOCAL_ONLY_API_PATTERNS. Add it to routeGuard.ts or remove x-loopback-only.`
      );
    }
  }