Security utilities
Key derivation, session listing, and hardening helpers.
Prefix: /api/security. Most actions require an authenticated dashboard or service context unless a specific route is called out on this page as anonymous.
POST /api/security/derive-key— body:licenseKey,saltBase64; returns derived key material for protected file flows.- Session discovery and revocation helpers for operators live alongside other security routes under the same prefix (exact paths depend on your build).
Confirm request and response shapes with a test call against your deployment before locking client DTOs.