純事實盤點（無判定軸）。涵蓋模組：
api/project、api/project_summary_report、api/subtask_status_history。 Blueprint url_prefix 皆為/api/1.0。所有 route 均掛@jwt_required()。 守門追蹤到 app service 層（含 helper_check_role/_check_auditor/_check_manager/resolve_*_check_*）。註：
api/project/routes/job_execution_device_route.py（JobExecutionDevices/Device/Bulk/ViewQuery）在api/project/__init__.py:91-94全數註解停用（FR-038 DEAD-V1，無 live FE 呼叫），未註冊、無 live URL，不列入下表。
Route files：project_route.py、audit_round_route.py、ap_docx_import_route.py、ar_import_route.py。
| Route path | Method | Route file:line | @jwt_required? | 呼叫的 service method | 現況守門 | 備註 |
|---|---|---|---|---|---|---|
/api/1.0/oscal-project/start |
POST | project_route.py:25 |
是 | ProjectStartAppService.start_project |
僅 JWT | 專案成立；任何登入者可建，建立者 fallback 補 role=manager（project_start_app_service.py:199）。無 owner/participant 前置守門 |
/api/1.0/projects/<project_uid>/audit-rounds |
POST | audit_round_route.py:50 |
是 | AuditRoundAppService.create_round |
已有: _check_role(...,"manager") @ audit_round_app_service.py:214（helper 定義 :99） |
建輪次 |
/api/1.0/projects/<project_uid>/audit-rounds/list |
POST | audit_round_route.py:65 |
是 | AuditRoundAppService.list_rounds |
僅 JWT | POST 實為列表查詢(讀)；list_rounds @ :195 無角色守門 |
/api/1.0/audit-round/<round_uid> |
GET | audit_round_route.py:75 |
是 | AuditRoundAppService.get_round |
僅 JWT | 讀取 detail；get_round @ :202 無角色守門 |
/api/1.0/audit-round/<round_uid>/launch-audit |
POST | audit_round_route.py:84 |
是 | AuditRoundAppService.launch_audit |
已有: _check_role(...,"manager") @ audit_round_app_service.py:358 |
狀態轉換 |
/api/1.0/audit-round/<round_uid>/start-auditing |
POST | audit_round_route.py:96 |
是 | AuditRoundAppService.start_auditing |
已有: _check_role(...,"auditor") @ audit_round_app_service.py:400 |
狀態轉換；manager override |
/api/1.0/audit-round/<round_uid>/close-round |
POST | audit_round_route.py:108 |
是 | AuditRoundAppService.close_round |
已有: _check_role(...,"manager") @ audit_round_app_service.py:489 |
狀態轉換 |
/api/1.0/audit-round/<round_uid>/launch-reverify |
POST | audit_round_route.py:120 |
是 | AuditRoundAppService.launch_reverify |
已有: _check_role(parent.project_id,...,"auditor") @ audit_round_app_service.py:534 |
狀態轉換；manager override |
/api/1.0/audit-round/<round_uid>/ap |
GET | audit_round_route.py:134 |
是 | AssessmentPlanAppService.get_ap_for_round |
僅 JWT | 讀取；get_ap_for_round @ :441 無角色守門 |
/api/1.0/audit-round/<round_uid>/ap/generate-draft |
POST | audit_round_route.py:144 |
是 | AssessmentPlanAppService.generate_draft_for_round |
已有: _check_auditor(...) @ assessment_plan_app_service.py:602（helper :230） |
重生 AP 草稿 |
/api/1.0/ap/<ap_uid>/reviewed-controls |
PUT | audit_round_route.py:157 |
是 | AssessmentPlanAppService.set_reviewed_controls |
已有: resolve_ap_and_check_auditor(...) @ assessment_plan_app_service.py:468（:190→_check_auditor :207） |
|
/api/1.0/ap/<ap_uid>/assessment-subjects |
PUT | audit_round_route.py:171 |
是 | AssessmentPlanAppService.set_assessment_subjects |
已有: resolve_ap_and_check_auditor(...) @ assessment_plan_app_service.py:480 |
|
/api/1.0/ap/<ap_uid>/tasks |
PUT | audit_round_route.py:185 |
是 | AssessmentPlanAppService.set_tasks |
已有: resolve_ap_and_check_auditor(...) @ assessment_plan_app_service.py:511 |
|
/api/1.0/ap/<ap_uid>/parties |
GET | audit_round_route.py:200 |
是 | AssessmentPlanAppService.list_ap_parties |
僅 JWT | 讀取；list_ap_parties @ :634 無角色守門 |
/api/1.0/ap/<ap_uid>/parties |
POST | audit_round_route.py:208 |
是 | AssessmentPlanAppService.add_ap_party |
已有: resolve_ap_and_check_auditor(...) @ assessment_plan_app_service.py:648 |
就地新增稽核人員（寫入） |
/api/1.0/ap/<ap_uid>/docx-imports/parse |
POST | ap_docx_import_route.py:40 |
是 | ApDocxImportAppService.upload_and_parse |
已有: resolve_ap_and_check_auditor(...) @ ap_docx_import_app_service.py:72 |
docx 上傳+解析 |
/api/1.0/ap-docx-import/<parse_uid> |
GET | ap_docx_import_route.py:63 |
是 | ApDocxImportAppService.get_parse_result |
已有: resolve_ap_and_check_participant(...) @ ap_docx_import_app_service.py:147（:210→GRC_NOT_PROJECT_PARTICIPANT :227） |
讀取 parse 預覽（participant gate，較寬） |
/api/1.0/ap-docx-import/<parse_uid> |
DELETE | ap_docx_import_route.py:78 |
是 | ApDocxImportAppService.discard_parse |
已有: resolve_ap_and_check_participant(...) @ ap_docx_import_app_service.py:175 |
soft delete（participant gate）；另 :256 tenant+is_admin 隔離 |
/api/1.0/ap-docx-import/<parse_uid>/confirm |
POST | ap_docx_import_route.py:98 |
是 | ApDocxImportAppService.confirm_import |
已有: resolve_ap_and_check_auditor(...) @ ap_docx_import_app_service.py:189 |
確認匯入（寫入，auditor gate） |
/api/1.0/audit-round/<round_uid>/ar-imports/parse |
POST | ar_import_route.py:40 |
是 | ArImportAppService.upload_and_parse |
已有: resolve_round_for_import(...) @ ar_import_app_service.py:74（AssessmentResultAppService.resolve_round_for_import→_check_auditor :147） |
xlsx 上傳+解析 |
/api/1.0/ar-import/<parse_uid> |
GET | ar_import_route.py:63 |
是 | ArImportAppService.get_parse_result |
已有: resolve_round_for_import(...) @ ar_import_app_service.py:185 |
讀取 parse 預覽（auditor gate）；另 :570 tenant+is_admin 隔離 |
/api/1.0/ar-import/<parse_uid> |
DELETE | ar_import_route.py:78 |
是 | ArImportAppService.discard_parse |
已有: resolve_round_for_import(...) @ ar_import_app_service.py:216 |
soft delete（auditor gate） |
/api/1.0/ar-import/<parse_uid>/confirm |
POST | ar_import_route.py:98 |
是 | ArImportAppService.confirm_import |
已有: resolve_round_for_import(...) @ ar_import_app_service.py:235 |
確認匯入（寫入，auditor gate） |
/api/1.0/audit-round/<round_uid>/ar/findings |
GET | audit_round_route.py:222 |
是 | AssessmentResultAppService.get_findings |
僅 JWT | 讀取；get_findings @ :385 無角色守門 |
/api/1.0/audit-round/<round_uid>/ar/finding/<finding_uid> |
PUT | audit_round_route.py:232 |
是 | AssessmentResultAppService.judge_finding |
已有: _check_auditor(...) @ assessment_result_app_service.py:521（helper :111） |
AO 判定 |
/api/1.0/audit-round/<round_uid>/ar/observations |
POST | audit_round_route.py:248 |
是 | AssessmentResultAppService.create_observation |
已有: _check_auditor(...) @ assessment_result_app_service.py:556 |
|
/api/1.0/audit-round/<round_uid>/ar/observation/<obs_uid> |
PUT | audit_round_route.py:265 |
是 | AssessmentResultAppService.update_observation |
已有: _check_auditor(...) @ assessment_result_app_service.py:583 |
|
/api/1.0/audit-round/<round_uid>/ar/observation/<obs_uid> |
DELETE | audit_round_route.py:279 |
是 | AssessmentResultAppService.delete_observation |
已有: _check_auditor(...) @ assessment_result_app_service.py:605 |
|
/api/1.0/audit-round/<round_uid>/ar/risks |
GET | audit_round_route.py:292 |
是 | AssessmentResultAppService.list_risks |
僅 JWT | 讀取；list_risks @ :688 無角色守門 |
/api/1.0/audit-round/<round_uid>/ar/risks |
POST | audit_round_route.py:300 |
是 | AssessmentResultAppService.add_risk |
已有: _check_auditor(...) @ assessment_result_app_service.py:678 |
建風險（寫入） |
/api/1.0/audit-round/<round_uid>/ar/finalize |
POST | audit_round_route.py:316 |
是 | AuditRoundAppService.finalize_audit |
已有: _check_role(...,"auditor") @ audit_round_app_service.py:431 |
狀態轉換；manager override |
/api/1.0/audit-round/<round_uid>/ar/risk/<risk_uid> |
PUT | audit_round_route.py:329 |
是 | AssessmentResultAppService.update_risk |
已有: _check_auditor(...) @ assessment_result_app_service.py:738 |
|
/api/1.0/audit-round/<round_uid>/ar/risk/<risk_uid> |
DELETE | audit_round_route.py:343 |
是 | AssessmentResultAppService.delete_risk |
已有: _check_auditor(...) @ assessment_result_app_service.py:752 |
|
/api/1.0/audit-round/<round_uid>/ar/risk/<risk_uid>/findings |
PUT | audit_round_route.py:357 |
是 | AssessmentResultAppService.link_risk_findings |
已有: _check_auditor(...) @ assessment_result_app_service.py:767 |
關聯 finding↔︎risk |
/api/1.0/audit-round/<round_uid>/poam-items |
GET | audit_round_route.py:372 |
是 | PoamAppService.list_items |
僅 JWT | 讀取；list_items @ :249 無角色守門 |
/api/1.0/audit-round/<round_uid>/poam-item/<item_uid> |
GET | audit_round_route.py:381 |
是 | PoamAppService.get_item |
僅 JWT | 讀取；get_item @ :274 無角色守門 |
/api/1.0/audit-round/<round_uid>/ar/risk/<risk_uid>/remediations |
POST | audit_round_route.py:391 |
是 | PoamAppService.add_remediation |
已有: _check_manager(...) @ poam_app_service.py:318（helper :91） |
建整改計畫 |
/api/1.0/audit-round/<round_uid>/remediation/<remediation_uid>/milestones |
POST | audit_round_route.py:406 |
是 | PoamAppService.add_milestone |
已有: _check_manager(...) @ poam_app_service.py:339 |
|
/api/1.0/audit-round/<round_uid>/poam-milestone/<milestone_uid> |
PUT | audit_round_route.py:425 |
是 | PoamAppService.update_milestone |
已有: _check_manager(...) @ poam_app_service.py:354 |
|
/api/1.0/audit-round/<round_uid>/poam-milestone/<milestone_uid> |
DELETE | audit_round_route.py:436 |
是 | PoamAppService.delete_milestone |
已有: _check_manager(...) @ poam_app_service.py:375 |
|
/api/1.0/audit-round/<round_uid>/remediation/<remediation_uid> |
DELETE | audit_round_route.py:449 |
是 | PoamAppService.delete_remediation |
已有: _check_manager(...) @ poam_app_service.py:388 |
Route files：project_summary_report_route.py、project_summary_report_history_route.py。 兩支 service（ProjectSummaryReportService、ProjectSummaryReportHistoryService）全檔無任何授權守門（無 ForbiddenError / 無 role / participant / is_admin 檢查）。
| Route path | Method | Route file:line | @jwt_required? | 呼叫的 service method | 現況守門 | 備註 |
|---|---|---|---|---|---|---|
/api/1.0/project-summary-reports |
POST | project_summary_report_route.py:36 |
是 | ProjectSummaryReportService.get_project_summary_reports_and_pager |
僅 JWT | POST 實為分頁查詢(讀) |
/api/1.0/project-summary-report |
POST | project_summary_report_route.py:56 |
是 | ProjectSummaryReportService.create_project_summary_report |
僅 JWT | 新增（寫入）；service :74 僅解析 project_uid→project_id，未檢查 caller 是否為該專案 participant/manager/owner（project-ownership-not-checked，即已知裸區） |
/api/1.0/project-summary-report/<uid> |
GET | project_summary_report_route.py:76 |
是 | ProjectSummaryReportService.get_project_summary_report |
僅 JWT | 讀取 detail |
/api/1.0/project-summary-report/<uid> |
PUT | project_summary_report_route.py:87 |
是 | ProjectSummaryReportService.update_project_summary_report |
僅 JWT | 編輯（寫入）；service :103 僅依 uid 更新，無 ownership 檢查 |
/api/1.0/project-summary-report/<uid> |
DELETE | project_summary_report_route.py:107 |
是 | ProjectSummaryReportService.delete_project_summary_report |
僅 JWT | 刪除（寫入）；service :128 僅依 uid 刪，無 ownership 檢查 |
/api/1.0/project-summary-report/export/<uid> |
GET | project_summary_report_route.py:118 |
是 | ProjectSummaryReportService.get_project_summary_report_by_uid |
僅 JWT | 敏感 GET（匯出 PDF，weasyprint）；:66 無 ownership 檢查 |
/api/1.0/project-summary-report/histories |
POST | project_summary_report_history_route.py:28 |
是 | ProjectSummaryReportHistoryService.get_project_summary_report_histories |
僅 JWT | POST 實為列表查詢(讀) |
/api/1.0/project-summary-report/history/<uid> |
GET | project_summary_report_history_route.py:44 |
是 | ProjectSummaryReportHistoryService.get_project_summary_report_history_by_uid |
僅 JWT | 讀取 detail |
/api/1.0/project-summary-report/history-revert |
POST | project_summary_report_history_route.py:58 |
是 | ProjectSummaryReportHistoryService.revert_data_from_cruise_project_report_history |
僅 JWT | 還原歷史（寫入）；service :35 依 report_uid/history_uid 還原，無 ownership 檢查 |
Route file：subtask_status_history_route.py。 SubtaskStatusHistoryService 全檔無任何授權守門（無 ForbiddenError / 無 role / participant / is_admin 檢查）。 註：SubtaskStatusHistoriesRoute 用 def get 但註冊在 /subtask-status-histories/<task_uid>，body 帶 filter（列表讀取）。
| Route path | Method | Route file:line | @jwt_required? | 呼叫的 service method | 現況守門 | 備註 |
|---|---|---|---|---|---|---|
/api/1.0/subtask-status-histories/<task_uid> |
GET | subtask_status_history_route.py:26 |
是 | SubtaskStatusHistoryService.get_subtask_status_histories |
僅 JWT | 列表讀取 by task_uid |
/api/1.0/subtask-status-history / /subtask-status-history/<uid> |
GET | subtask_status_history_route.py:39 |
是 | SubtaskStatusHistoryService.get_subtask_status_history |
僅 JWT | 讀取 detail by uid |
/api/1.0/subtask-status-history |
POST | subtask_status_history_route.py:49 |
是 | SubtaskStatusHistoryService.add_subtask_status_history |
僅 JWT | 新增（寫入）；:40 無角色/ownership 守門 |
/api/1.0/subtask-status-history/<uid> |
PUT | subtask_status_history_route.py:60 |
是 | SubtaskStatusHistoryService.update_subtask_status_history |
僅 JWT | 修改（寫入）；:53 無角色/ownership 守門 |
/api/1.0/subtask-status-history/<uid> |
DELETE | subtask_status_history_route.py:70 |
是 | SubtaskStatusHistoryService.delete_subtask_status_history |
僅 JWT | 刪除（寫入）；:67 無角色/ownership 守門 |