# Generated routes

Some features generate their routes for you:

- magic-link sign-in and passkeys ([Magic links](magic-links.md),
  [Passkeys](passkeys.md)), and `POST /auth/exchange`
  ([Identity](identity.md));
- the privacy requests ([Data requests](data-requests.md));
- `GET /flags` ([Feature flags](feature-flags.md));
- a provider package's webhooks ([Webhooks](webhooks.md));
- each API's `GET <prefix>/openapi.json` ([OpenAPI](openapi.md));
- connecting and disconnecting an OAuth grant:
  `POST /connections/<name>/start`, `GET /connections/<name>/callback` and
  `POST /connections/<name>/disconnect`
  ([Acting for a user at another service: OAuth grants](acting-for-a-user-at-another-service-oauth-grants.md),
  [Acting for each user: OAuth grants](acting-for-each-user-oauth-grants.md)).

Jadpo generates endpoints only, never pages: the app's frontend owns every
page. Generated routes appear in `jadpo routes`, the API record and OpenAPI
like any route, marked generated.

## Moving or replacing one

- A generated route takes a `path:` setting where its feature is
  configured (`magic_link: { path: "/login" }`).
- Or the feature takes `generate_routes: false`, and the app writes its own
  routes over the feature's generated operations (`magic_links.request`,
  `magic_links.redeem`, `sessions.start`), which keep every protection.
- Webhook routes, and passkeys' routes, whose bodies are WebAuthn's rather
  than the app's, can change path but can't be switched off
  ([Passkeys](passkeys.md)).
- A generated route's response shape is fixed; only its path changes.