| Option | Type | Description |
|---|---|---|
| method | string | HTTP method: GET, POST, PUT, PATCH, DELETE |
| path | string | URL path, supports :param and *wildcard |
| expose | boolean | If true, accessible from outside (default: false) |
| auth | boolean | If true, requires authentication |
| sensitive | boolean | If true, redacts request/response payloads from traces |
Encore supports four endpoint configurations:
Include an HttpStatus field in your response to return custom status codes:
Encore validates requests at runtime using TypeScript types. Add constraints for stricter validation:
Use & for AND logic (must pass all rules) and | for OR logic (must pass at least one):
| Validator | Applies To | Example |
|---|---|---|
| Min<N> | number | age: number & Min<18> |
| Max<N> | number | count: number & Max<100> |
| MinLen<N> | string, array | name: string & MinLen<1> |
| MaxLen<N> | string, array | tags: string[] & MaxLen<10> |
| IsEmail | string | email: string & IsEmail |
| IsURL | string | link: string & IsURL |
| StartsWith<S> | string | id: string & StartsWith<"usr_"> |
| EndsWith<S> | string | file: string & EndsWith<".json"> |
| MatchesRegexp<R> | string | code: string & MatchesRegexp<"^[A-Z]{3}$"> |
Invalid requests return 400 with details:
Use APIError for proper HTTP error responses:
| Code | HTTP Status | Usage |
|---|---|---|
| NotFound | 404 | Resource doesn't exist |
| InvalidArgument | 400 | Bad input |
| Unauthenticated | 401 | Missing/invalid auth |
| PermissionDenied | 403 | Not allowed |
| AlreadyExists | 409 | Duplicate resource |
Serve static files (HTML, CSS, JS, images) with api.static: