Routes and flows with an HTTP trigger each carry a rule, checked before any of your code runs.

​
In Studio

A route’s editor has a Who passes (or policy) picker, the same as everywhere. Which endpoints exist, and who may call each. Rules on record fields filter lists in the database, so people only ever get back rows they may see. A route also has Rate limit and Enabled (disabled routes answer 404).

​
What a route rule sees

$auth, $credential, $request (including $request.params for {id} and $request.query), $env, $now, and $input (the body, when it has been read). There is no $record: a route isn’t a row.

​
Check who owns what inside

A rule on a route can tell you the caller is signed in and holds a permission. It cannot tell you that order 42 is theirs: that depends on data. The flow must check:
  1. Load the order.
  2. Confirm order.customer_id equals the caller.
  3. Only then charge the card.
If you skip step 2, any signed-in person can pay anyone’s order. Make “load, then check owner” the first step of every route that takes an id. A good habit: let the table’s rules do the check. If the flow reads the order as the caller (with the caller’s identity, not as a service), the table’s get rule refuses someone else’s order for free.

​
Public routes

Some routes are public by design (a webhook receiver, a “contact us” form). Keep them safe:
  • Add a rate limit, and limit the key that calls it by address and route in API keys.
  • Validate every input.
  • Don’t return anything you wouldn’t put on a public page.
  • Use inbound hook verification for services that call you (Webhooks).

​
Refusals

Routes

Calling them.

Testing

Prove them.