routing

Routing rules · Can change or delete · actions: get, check, set

For reading use routing_read, which is read-only and needs no approval: "get", "check" here are deprecated (still works). The project's routing.json, applied by the platform in front of the app (in preview now; production gets it with the code when published). action "get": the file and whether it is in force. action "check": what a visitor with no password gets at path (env, default preview; or host, another address under the site domain such as an old slug's), asked from outside through the routing, since http_get and http_request skip it; with username and password, whether that sign-in gets in. action "set": replace the whole file with routing (an object; {} removes every rule). Keys: redirects, rewrites (to a path, optionally on another service from services.json), headers (response headers), cors, auth (username + password for paths; the password is hashed and never shown; omit it to keep an existing rule's, or on a new rule to let the owner choose it in the portal, which is better than choosing one for them), allow_ips, allow_countries (ISO codes, from Cloudflare), error_pages (status or "4xx"/"5xx" → a path the app serves, shown to browsers). Sources are paths with :name for one segment and :name* for the rest. Example: {"redirects":[{"source":"/old/:path*","destination":"/new/:path*","permanent":true}], "rewrites":[{"source":"/api/:path*","destination":"/:path*","service":"api"}], "headers":[{"source":"/assets/:path*","headers":{"Cache-Control":"public, max-age=31536000, immutable"}}], "cors":[{"source":"/api/:path*","origins":["https://example.com"],"methods":["GET","POST"],"headers":["Content-Type"]}], "auth":[{"source":"/admin/:path*","username":"admin","password":"at least 8 characters"}], "allow_ips":["203.0.113.0/24"],"allow_countries":["DE","NL"],"error_pages":{"404":"/404.html","5xx":"/500.html"}}