OpenAPI spec at /api/docs with a Scalar viewer, opt-in via FEAT_API_DOCS

src/routes/audit/+server.ts

@@ -3,6 +3,21 @@ import { authorize, enterpriseRequired } from '$lib/server/authorize';
 import { getAuditLogs, getAuditLogUsers, type AuditLogFilters, type AuditEntityType, type AuditAction } from '$lib/server/db';
 import type { RequestHandler } from './$types';
 
+/**
+ * @openapi
+ * summary: List audit log entries with optional filters (Enterprise only)
+ * query: username:string
+ * query: entity_type:string
+ * query: action:string
+ * query: environment_id:integer
+ * query: from_date:string
+ * query: to_date:string
+ * query: limit:integer
+ * query: offset:integer
+ * resp-200: {logs:array<{id:integer!, userId:integer, username:string!, action:string!, entityType:string!, entityId:string, entityName:string, environmentId:integer, description:string, details:{}, ipAddress:string, userAgent:string, createdAt:string!}>!, total:integer!, limit:integer!, offset:integer!}
+ * resp-403: Enterprise license required, or permission denied to view the audit log
+ * resp-500: Failed to fetch audit logs
+ */
 export const GET: RequestHandler = async ({ url, cookies }) => {
 	const auth = await authorize(cookies);
 

src/routes/audit/users/+server.ts

@@ -3,6 +3,13 @@ import { authorize, enterpriseRequired } from '$lib/server/authorize';
 import { getAuditLogUsers } from '$lib/server/db';
 import type { RequestHandler } from './$types';
 
+/**
+ * @openapi
+ * summary: List distinct usernames that appear in the audit log, for use as a filter dropdown (Enterprise only)
+ * resp-200: array<string>
+ * resp-403: Enterprise license required, or permission denied to view the audit log
+ * resp-500: Failed to fetch users
+ */
 export const GET: RequestHandler = async ({ cookies }) => {
 	const auth = await authorize(cookies);