OpenAPI spec at /api/docs with a Scalar viewer, opt-in via FEAT_API_DOCS

src/routes/api/templates/+server.ts

@@ -188,6 +188,15 @@ async function fetchSource(source: TemplateSource): Promise<TemplateItem[]> {
 	}
 }
 
+/**
+ * GET /api/templates - Aggregated app templates from enabled sources
+ *
+ * @openapi
+ * summary: Return the normalized app templates aggregated from all enabled template sources (server-side cached for 1 hour)
+ * resp-200: array<{id:string!, type:string!, title:string!, description:string!, logo:string!, categories:array<string>!, source:string!, image:string, projectUrl:string}>
+ * resp-200-example: [{"id":"a1b2c3","type":"container","title":"Nginx","description":"Web server","logo":"https://example.com/nginx.png","categories":["web"],"source":"LinuxServer.io","image":"lscr.io/linuxserver/nginx:latest","projectUrl":"https://github.com/linuxserver/docker-nginx"}]
+ * resp-403: Permission denied
+ */
 export const GET: RequestHandler = async ({ cookies }) => {
 	const auth = await authorize(cookies);
 	if (auth.authEnabled && !await auth.can('templates', 'view')) {

src/routes/api/templates/compose/+server.ts

@@ -79,6 +79,19 @@ async function fetchStackCompose(repository: { url: string; stackfile: string })
 	return await response.text();
 }
 
+/**
+ * POST /api/templates/compose - Generate/fetch a compose file for a template
+ *
+ * @openapi
+ * summary: Return the compose YAML for a template — generated for container templates, fetched from the repository for stack templates
+ * body: {template:{id:string, type:string, title:string, image:string, repository:{url:string, stackfile:string}}!}
+ * body-example: {"template":{"id":"a1b2c3","type":"container","title":"Nginx","image":"nginx:latest"}}
+ * resp-200: {compose:string!}
+ * resp-200-example: {"compose":"services:\n  nginx:\n    image: nginx:latest\n    restart: unless-stopped\n"}
+ * resp-400: Template is missing from the request body
+ * resp-403: Permission denied
+ * resp-500: Failed to generate or fetch the compose file
+ */
 export const POST: RequestHandler = async ({ request, cookies }) => {
 	const auth = await authorize(cookies);
 	if (auth.authEnabled && !await auth.can('templates', 'deploy')) {

src/routes/api/templates/sources/+server.ts

@@ -3,6 +3,15 @@ import { json } from '@sveltejs/kit';
 import { authorize } from '$lib/server/authorize';
 import { getTemplateSources, updateTemplateSource, addTemplateSource, deleteTemplateSource } from '$lib/server/templates';
 
+/**
+ * GET /api/templates/sources - List configured template sources
+ *
+ * @openapi
+ * summary: List all configured template sources (built-in and custom)
+ * resp-200: array<{id:integer!, name:string!, url:string!, enabled:boolean!}>
+ * resp-200-example: [{"id":1,"name":"LinuxServer.io","url":"https://fleet.linuxserver.io/api/v1/images","enabled":true}]
+ * resp-403: Permission denied
+ */
 export const GET: RequestHandler = async ({ cookies }) => {
 	const auth = await authorize(cookies);
 	if (auth.authEnabled && !await auth.can('templates', 'view')) {
@@ -14,6 +23,18 @@ export const GET: RequestHandler = async ({ cookies }) => {
 };
 
 // Toggle enabled or update a source
+/**
+ * PUT /api/templates/sources - Toggle or update a template source
+ *
+ * @openapi
+ * summary: Update a template source — toggle enabled, or change its name/URL (only provided fields are changed)
+ * body: {id:integer!, enabled:boolean, name:string, url:string}
+ * body-example: {"id":3,"enabled":false}
+ * resp-200: {ok:boolean!}
+ * resp-200-example: {"ok":true}
+ * resp-400: Missing id
+ * resp-403: Permission denied
+ */
 export const PUT: RequestHandler = async ({ request, cookies }) => {
 	const auth = await authorize(cookies);
 	if (auth.authEnabled && !await auth.can('templates', 'manage')) {
@@ -33,6 +54,18 @@ export const PUT: RequestHandler = async ({ request, cookies }) => {
 };
 
 // Add a custom source
+/**
+ * POST /api/templates/sources - Add a custom template source
+ *
+ * @openapi
+ * summary: Add a custom template source with a name and URL
+ * body: {name:string!, url:string!}
+ * body-example: {"name":"My Templates","url":"https://example.com/templates.json"}
+ * resp-200: {id:integer!, name:string!, url:string!, enabled:boolean!}
+ * resp-200-example: {"id":4,"name":"My Templates","url":"https://example.com/templates.json","enabled":true}
+ * resp-400: Name and URL are required
+ * resp-403: Permission denied
+ */
 export const POST: RequestHandler = async ({ request, cookies }) => {
 	const auth = await authorize(cookies);
 	if (auth.authEnabled && !await auth.can('templates', 'manage')) {
@@ -49,6 +82,17 @@ export const POST: RequestHandler = async ({ request, cookies }) => {
 };
 
 // Delete a custom source
+/**
+ * DELETE /api/templates/sources - Delete a custom template source
+ *
+ * @openapi
+ * summary: Delete a custom template source by ID
+ * query: id:integer! ID of the template source to delete (from GET /api/templates/sources)
+ * resp-200: {ok:boolean!}
+ * resp-200-example: {"ok":true}
+ * resp-400: Missing id
+ * resp-403: Permission denied
+ */
 export const DELETE: RequestHandler = async ({ url, cookies }) => {
 	const auth = await authorize(cookies);
 	if (auth.authEnabled && !await auth.can('templates', 'manage')) {