appserver ↔ dash-app — API comparison

Left: Flask-RESTful apprunner/app_server + FastAPI appserver4/{cim,dim,monitor}.
Right: FastAPI dash-app/services/*. External path prefixes shown from nginx.conf.

~140

Endpoints in dash-app

~85

Endpoints in appserver

Mapped (both sides)

New in dash-app

Dropped from appserver

Mapped endpoints present in both

Same functional surface, generally with a rename or namespace move. Where dash-app has both a modern (/config/infra/*, /config/ops/*) and a compat (/config/admin/*) path, both are listed — the compat one preserves the appserver contract byte-for-byte for old clients.

Auth & account

appserver	dash-app	Notes
POST `/admin/login`	POST `/config/common/login` POST `/config/admin/login`	Cognito replaced by local bcrypt + JWT. Compat path kept for old ICD clients.
POST `/admin/update_password` POST `/change_password`	POST `/config/common/update_password`	Old-password verify + hash-and-store.

Company / user / infra

appserver	dash-app	Notes
GET `/admin/company` POST `/admin/company` DEL `/admin/company`	GET `/config/infra/company` POST `/config/infra/company` DEL `/config/infra/company/{id}` + compat `/config/admin/company`	DORI_ADMIN sees every tenant; others see just their own row. UUID-minted `company_id` matches appserver `dar_model.Company().add()`.
GET `/admin/user` POST `/admin/user` DEL `/admin/user`	GET `/config/infra/user` POST `/config/infra/user` DEL `/config/infra/user/{id}` GET/POST/DEL `/config/common/user` + compat `/config/admin/user`	Split: `/infra/user` = platform-admin cross-tenant, `/common/user` = tenant-scoped.
GET `/admin/credentials` POST `/admin/credentials` DEL `/admin/credentials`	GET `/config/infra/credentials` POST `/config/infra/credentials` + compat `/config/admin/credentials`	Delete removed — creds are overwritten instead.
GET `/admin/mlc` POST `/admin/mlc` DEL `/admin/mlc` GET `/admin/mlclist`	GET `/config/infra/mlc` POST `/config/infra/mlc` DEL `/config/infra/mlc/{id}` + compat `/config/admin/mlc`	`/mlclist` collapsed into `GET /mlc`.
GET `/client` POST `/client` DEL `/client`	GET `/config/infra/client` POST `/config/infra/client` DEL `/config/infra/client/{id}`	Namespaced under `/infra/`.
GET `/client_user` POST `/client_user` DEL `/client_user`	GET `/config/ops/client_user`	Write side folded into `POST /config/infra/client` body (attach users at create time).

Ops — location / device / subscriber

appserver	dash-app	Notes
GET `/admin/location` POST `/admin/location` DEL `/admin/location`	GET `/config/ops/locations` POST `/config/ops/locations` DEL `/config/ops/locations/{id}` + compat `/config/admin/locations`	UUID-minted `location_id` matches `dar_model.Location().add()`.
GET `/admin/camera` POST `/admin/camera` DEL `/admin/camera` GET `/admin/monitor` POST `/admin/monitor` DEL `/admin/monitor`	GET `/config/ops/device` POST `/config/ops/device` DEL `/config/ops/device/{id}` + compat `/config/device`	alembic 003 folded `d_monitor` into `device`. Capture-worker fields are now nullable columns on the device row.
GET `/admin/subscription` POST `/admin/subscription` DEL `/admin/subscription` GET `/admin/subscriptionslist`	GET `/config/ops/subscriber` POST `/config/ops/subscriber` GET `/config/ops/subscriptions` POST `/config/ops/subscriptions`	Renamed & split: `/subscriber` = the person, `/subscriptions` = event-type ↔ subscriber wiring.
GET `/user_camera` POST `/user_camera` DEL `/user_camera`	GET `/dmf/user_camera` POST `/dmf/user_camera`	Moved into DMF (media flow) service.
GET `/list_employees`	GET `/config/ops/employees` + compat `/config/list_employees`

Events / analytics

appserver	dash-app	Notes
POST `/events` POST `/get_last_events`	POST `/analytics/get_events` POST `/analytics/get_last_events`	Moved to dedicated analytics service.
POST `/clove_dental/list_status` POST `/clove_dental/update_status`	POST `/analytics/clove_dental/list_status` POST `/analytics/clove_dental/update_status`	Tenant path preserved for existing Clove clients.
POST `/clove_dental/get_events_combined` POST `/clove_dental/get_events_combined_counts`	POST `/analytics/clove_dental/get_events_combined` POST `/analytics/get_events_combined` POST `/analytics/clove_dental/get_events_combined_counts` POST `/analytics/event_counts`	Generic aliases (`/get_events_combined`, `/event_counts`) added for non-tenant callers.
POST `/get_raw_snippets`	POST `/analytics/get_raw_snippets`
GET `/get_image`	GET `/analytics/get_image`
POST `/clove_dental/clove_trigger_events`	POST `/jobs/clove_dental/clove_trigger_events` POST `/jobs/start_trigger`	Trigger flow moved to job_app; `/start_trigger` is the generic alias.

Job runner

appserver	dash-app	Notes
POST `/live/start_job`	POST `/jobs/start_job` POST `/jobs/start_live_job`	Both aliases behind one handler.
POST `/live/stop_job`	POST `/jobs/stop_job` POST `/jobs/stop_live_jobs`
GET `/auth_callback`	GET `/jobs/auth_callback`	Cognito OAuth callback stub kept, no Cognito integration behind it.

CIM / DIM / Monitor (appserver4 ↔ dash-app)

appserver4	dash-app	Notes
POST `/event` (cim)	POST `/cim/event/`
POST `/message` (cim)	POST `/cim/message/` POST `/cim/messages/`	Batch variant added.
POST `/event_callback`	POST `/cim/event_callback/`
POST `/kit_callback`	POST `/cim/kit_callback/`
POST `/publish`	POST `/cim/publish/`
POST `/upload_plugin`	POST `/cim/upload_plugin`	DIM's copy was dropped.
POST `/gmail_test`	POST `/cim/gmail_test/`
GET `/echo/{thing}`	GET `/cim/echo/{thing}`, `/monitor/echo/{thing}`, plus `/dmf/echo`, `/dim/echo`, etc.
POST `/system_event` (monitor)	POST `/monitor/system_event/` POST `/config/infra/system_event`	Duplicate handler on config_app for legacy pushes.
WS `/ws/notifications/{device}` (dim)	WS `/dim/ws/notifications/{device}` WS `/dmf/ws/notifications/{device}`	DMF has its own notification channel too.

New in dash-app no appserver counterpart

Endpoints that didn't exist in appserver — either brand-new features or subsystems that appserver handled outside the HTTP layer (WMS, DMF, MLC config junction, service bundles).

Platform-admin: MLC config + service bundles

Method	Path	Purpose
GET	`/config/infra/mlc_config`	List MLC tuning configs (predictdb creds, NMS, sampling).
POST	`/config/infra/mlc_config`	Create MLC config row (platform-level, not tenant-scoped).
PATCH	`/config/infra/mlc_config/{id}`	Partial update.
DEL	`/config/infra/mlc_config/{id}`
GET	`/config/infra/mlc_config/{id}/companies`	List companies assigned to this config.
POST	`/config/infra/mlc_config/{id}/companies`	Attach companies (junction row insert).
DEL	`/config/infra/mlc_config/{id}/companies/{company_id}`	Detach one company.
GET	`/config/infra/service_bundle`	List service bundles.
POST	`/config/infra/service_bundle`	Create bundle.
DEL	`/config/infra/service_bundle/{id}`
GET	`/config/infra/company_config`	Tenant-wide key/value config.
POST	`/config/infra/company_config`	Upsert config keys.

App — parts & dynamic kits

Method	Path	Purpose
GET	`/config/app/part`	List parts (SKU catalog).
POST	`/config/app/part`	Create part.
DEL	`/config/app/part/{part_id}`
POST	`/config/app/part_image`	Attach reference image to a part.
GET	`/config/app/dynamic_kit`	List dynamic kits.
POST	`/config/app/dynamic_kit`	Create kit + its part rows.
DEL	`/config/app/dynamic_kit/{kit_id}`
POST	`/config/app/dynamic_kit_update`	Update kit & recompute part list.

Ops additions

Method	Path	Purpose
GET	`/config/ops/event_type`	Event-type catalog (public).

Jobs additions

Method	Path	Purpose
DEL	`/jobs/v2/job/{request_id}`	Cancel a queued/running job.
GET	`/jobs/getjobslist`	Job history for the tenant.
POST	`/jobs/start_batch_job`	Kick off a bulk-processing job.
POST	`/jobs/stop_batch_job`
POST	`/jobs/file_upload`	Direct file upload endpoint.
POST	`/jobs/upload_snippet`
POST	`/jobs/upload_thumbnail`
GET / POST / DEL	`/jobs/dynamic_kit`, `/jobs/dynamic_kit_update`	Job-side dynamic kit mgmt (mirror of `/config/app/dynamic_kit`).
POST	`/jobs/v2/add_benchmark_result`	Post benchmark run outcome.
POST	`/jobs/call_back_server`	Generic callback receiver.

Analytics additions

Method	Path	Purpose
POST	`/analytics/search_events`	Full-text / filter search across events.
GET / POST	`/analytics/event_note`	Per-event operator notes.
GET	`/analytics/v2/get_file`	Signed-URL file fetch.

DMF — Data / Media Flow (entire service)

Method	Path	Purpose
POST	`/dmf/capture_image`, `/dmf/capture_video`, `/dmf/media`	Enqueue capture on a camera.
GET	`/dmf/media`	List captured media for the tenant.
DEL	`/dmf/media`	Bulk delete.
GET / POST	`/dmf/images`	Image roster / bulk register.
GET	`/dmf/image_detail`	Per-image predictions + metadata.
POST	`/dmf/image_comment`, `/dmf/kit_comment`, `/dmf/prediction_comment`	Reviewer annotations.
GET	`/dmf/labels`	Label catalog.
GET	`/dmf/location`, `/dmf/part`, `/dmf/stream`	Read-only projections for the DMF UI.
POST	`/dmf/part`, `/dmf/part_image`	Part write side (mirrors `/config/app/part`).
POST	`/dmf/login`	Standalone DMF login for the labeling UI.
GET	`/dmf/job`, `/dmf/job_media`	Job-side inspection.
GET	`/dmf/cvat`, `/dmf/cvat_orgs`	CVAT project sync.
POST	`/dmf/cvat_upload`	Push labeled data to CVAT.
GET	`/dmf/export`, `/dmf/export_dori`	Dataset export (COCO / Dori format).

Warehouse service (entire service)

Method	Path	Purpose
POST	`/warehouse/pallet_result/`	Ingest a pallet-scan result.
POST	`/warehouse/pallet_result/list`	Query pallet results with filters.
POST	`/warehouse/pallet_result/{id}/ack`	Acknowledge a result.
GET	`/warehouse/dashboard/stats`, `/throughput`, `/suppliers`, `/docks`	WMS dashboard aggregations.

DIM additions

Method	Path	Purpose
GET	`/dim/stats`	Connected-device stats for the DIM UI.

Dropped from appserver not migrated

Endpoints on appserver that have no counterpart in dash-app. Many were sunset when the subsystem was retired (Cognito auth, safety-index, ZoneMinder scaffolding); others were runtime-debug endpoints that never made the cut.

Cognito auth flow — replaced by local bcrypt/JWT

Method	appserver path	Reason
POST	`/confirm_signup`	Cognito-specific.
POST	`/confirm_login`	Cognito-specific.
POST	`/resend_confirmation_code`	Cognito-specific.
POST	`/forgot_password`	Not ported — internal password reset only.
POST	`/confirm_forgot_password`	Same.
GET	`/refresh_token`	JWT is short-lived; clients re-login.
GET	`/check_credentials`	Rolled into `/login`.

Safety-index / incident / alerts subsystem

Method	appserver path	Reason
POST	`/list_safety_indexes`	Safety-index feature retired.
POST	`/list_incidents`	Incident concept folded into generic events.
POST	`/update_incident`
POST	`/get_incident_counts`	Superseded by `/analytics/event_counts`.
POST	`/list_alerts`	Alerts UI dropped.
GET	`/incident`
POST	`/get_tickets_counts`	Ticketing not migrated.
POST	`/get_alerts_counts`	Superseded by `/analytics/event_counts`.

Runtime debug / benchmark endpoints

Method	appserver path	Reason
POST	`/raw_get_events`	Debug-only; no client depends on it.
POST	`/raw_get_events_summary`	Same.
POST	`/get_runtime_events`	MLC runtime moved to internal pub/sub.
POST	`/get_runtime_predictions`	Same.
POST	`/benchmark_events`	Partly replaced by `/jobs/v2/add_benchmark_result`.
POST	`/get_event_snippets`	Replaced by `/analytics/get_raw_snippets`.
POST	`/get_annotations`	Annotation store moved to DMF.
POST	`/get_file_images`	Replaced by `/dmf/images`.
GET	`/get_info`	Legacy debug ping.
GET	`/get_documentation`	Docs no longer served from the API.

Camera / MLC config utilities

Method	appserver path	Reason
POST	`/update_camera_config`	Camera config is now columns on `device`; updated via `POST /config/ops/device`.
GET/POST	`/mlc_camera_config`	Superseded by the `/config/infra/mlc_config` junction API.
GET/POST	`/post_process_code`	Post-process code now shipped in service-bundle rows.
POST	`/dashboard_stream`	Replaced by WebSocket at `/dim/ws/notifications/{device}`.

Admin scaffolding — dropped subsystems

Method	appserver path	Reason
GET/POST/DEL	`/admin/floormap`	Floormap UI feature dropped.
GET/POST/DEL	`/admin/vms`	VMS integration dropped.
GET/POST/DEL	`/admin/monitor`	Folded into `device` (alembic 003).
GET	`/admin/zmmonitorslist`	ZoneMinder integration removed.
GET	`/admin/mlclist`	Rolled into `GET /config/infra/mlc`.
GET	`/admin/subscriptionslist`	Rolled into `GET /config/ops/subscriber`.

Notes & methodology

dash-app endpoint list gathered from @router.<method> and @app.<method> decorators across every service under services/*/src/web/. Nginx prefixes taken from nginx.conf: /config → config_app, /jobs//live → job_app, /analytics, /cim, /dmf, /dim, /monitor, /warehouse.
appserver endpoint list gathered from api.add_resource wiring + the swagger files at apprunner/swagger/*.yaml (authoritative for the URL surface). appserver4 sub-services (cim/dim/monitor) added via their FastAPI decorators.
"Mapped" means functionally equivalent — same intent, may take a slightly different request/response shape. The /config/admin/* and /config/device paths under dash-app are byte-for-byte compat shims for old clients hitting the appserver URL scheme.
Counts are approximate — a POST/GET/DELETE on the same URL counts as one endpoint on the appserver side (Flask Resource class covers all three) but as three separate rows on the dash-app side (each has its own FastAPI decorator). Adjusted where obvious.
Health/echo endpoints (GET /echo) exist on every dash-app service and are omitted from the "new" table for brevity — they're implicit smoke tests, not part of the product surface.

Generated for the feat/icd-platform-admin-and-mlc-config branch as of the current working tree. Cross-reference: services/*/src/web/*.py in dash-app, apprunner/app_server/safespace_{server,admin}.py and appserver4/{cim,dim,monitor}/src/web/*.py in appserver.