docs/openapi.json.
That file is produced by scripts/generate-public-openapi.mjs, which filters the backend Swagger document through an explicit endpoint whitelist. This prevents internal endpoints from appearing in client docs when the backend Swagger document contains admin, support, script, frontend-only, or infrastructure routes.