---
title: "Returns the in-memory authorization manifest as JSON."
method: GET
path: "/api/v1/core/authz/manifest"
tags: ["Core/Authz"]
---

# Returns the in-memory authorization manifest as JSON.

`GET /api/v1/core/authz/manifest`

Filter to a single module via `?module=Core` (case-sensitive, matches the
namespace-derived module name). Add `?includeDrift=true` to receive the drift
section alongside the entries — comparing the manifest with the effective
`Feature` + `Authorization` state in the database. Drift is computed only
when requested because it triggers a DB read; the entry list alone is served from
the cached scan.


The payload uses `System.Text.Json` with camelCase property names and enums as
strings (`"Page"`, not `1`). Field names are part of the contract — see
`AuthorizationManifestApiResponse` for the canonical schema.

## Query parameters

- `module` string
- `includeDrift` boolean

## Response `200`

Manifest returned

- ApiResponseAuthorizationManifestApiResponse — Standard API response envelope. All API endpoints return this structure. `data`: the payload (object or collection). `pagination`: present only for paginated collections.
  - `data` AuthorizationManifestApiResponse — JSON payload returned by `GET /api/v1/core/authz/manifest`. Designed for cross-environment diffs, CI gates, and external audit tooling — every field uses camelCase via System.Text.Json.Serialization.JsonPropertyNameAttribute and enums serialize as strings (`"Page"`, not `1`).
    - `generatedAt` string, date-time — UTC timestamp captured at request handling time.
    - `environment` string, nullable — Hosting environment name (`Development`, `Preprod`, `Production`, …).
    - `entries` AuthorizationManifestEntryApiDto[], nullable — All manifest entries, optionally filtered by `?module=`.
      - `source` 'Menu' | 'Page' | 'Service' | 'ApiEndpoint' | 'SensitivePattern' — Origin of an authorization declaration in the platform. Four declarative Feature sources plus one runtime safety-net source — see `IAuthorizationManifestService` for the scan strategy of each.
      - `module` string, nullable
      - `declaringType` string, nullable
      - `memberName` string, nullable
      - `fullKey` string, nullable
      - `rolesDeclared` string[], nullable
      - `isSensitivePattern` boolean
      - `routeTemplate` string, nullable
    - `drift` DriftEntryApiDto[], nullable — Drift list — present only when the request asks for it via `?includeDrift=true`.
      - `fullKey` string, nullable
      - `kind` 'OrphanInDb' | 'MissingInDb' | 'RoleMismatch' — Kind of drift between the code-declared manifest and the effective DB state.
      - `detail` string, nullable
  - `pagination` PaginationMeta — Pagination metadata included in paginated API responses.
    - `page` integer
    - `pageSize` integer
    - `totalCount` integer
    - `totalPages` integer

## Other responses

- `401` — Not authenticated
- `403` — Authenticated but not SuperAdmin

---

[API](https://skmtc.net/neotimo/apis/neotimo-api.md) · [All operations](https://skmtc.net/neotimo/apis/neotimo-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/neotimo/neotimo-api/revisions/2ecf51b1543e/schema)