List Paths That Skip Sign-in
The paths of an endpoint with sign-in that work without it, such as a webhook or a health check, and what the list means. In the dashboard: Sign-in & access › Sign-in, under Paths that skip sign-in. How requests are matched is in Paths that skip sign-in.
- open — every path needs sign-in, except the listed ones, for their methods.
- protect — only the listed paths need sign-in, for their methods. Every other path is open to anyone, pages added later included.
With no path listed, every path needs sign-in in either mode. The list decides nothing while the endpoint has no sign-in (sign_in_on: false).
Path parameters
uuid string (uuid) Req
The endpoint's
uuid from /endpoints.Response (200 OK)
endpoint_uuid string (uuid)
The endpoint.
mode string
sign_in_on boolean
true when the endpoint has sign-in (mode basic or sso, with a sign-in method on).older_protected_paths boolean
true while the endpoint's sign-in settings still list protected_paths, the older setting. No path can be listed here until you send "protected_paths": [] there.max_paths integer
The most paths the endpoint can list.
paths[] array
The listed paths, oldest first (
[] when none).paths[].path string
Exact (
/health), or a folder and everything under it (/webhooks/*, /webhooks/**).paths[].methods string[]
The methods the path applies to, upper-case, or
["*"] for every method.paths[].signature object | null
The webhook signature check of an open path, or
null: provider (github, slack, stripe or generic), secret (always "****": the signing secret is never shown), and for generic its signature_header, algorithm and signature_prefix. locked: true means your plan doesn't have Verify Webhook: the path needs sign-in until the plan has it again or you remove the check.paths[].created_at, paths[].updated_at datetime
RFC 3339 UTC.
Errors
401 Unauthorized
Missing auth.
403 Forbidden
Your role lacks
endpoints:read in the active account.404 Not Found
No such endpoint in your active account.
Request
curl "https://api.ngris.com/v1/endpoints/019bb1e4-e785-77d2-9966-c3cff31d0a0e/access-paths" \
-H "X-API-KEY: <your_api_key>"
CLI
ngris api endpoint-access-paths list 019bb1e4-e785-77d2-9966-c3cff31d0a0e
Response — 200 OK
{
"endpoint_uuid": "019bb1e4-e785-77d2-9966-c3cff31d0a0e",
"mode": "open",
"sign_in_on": true,
"older_protected_paths": false,
"max_paths": 50,
"paths": [
{
"uuid": "019c1a20-5b7e-7c41-9a3e-2f6d8b0c4e11",
"path": "/webhooks/github",
"methods": ["POST"],
"signature": {
"provider": "github",
"secret": "****",
"signature_header": "",
"algorithm": "",
"signature_prefix": "",
"locked": false
},
"created_at": "2026-11-12T09:00:00Z",
"updated_at": "2026-11-12T09:00:00Z"
},
{
"uuid": "019c1a20-6c1d-7f02-8b47-91e3a5d2c7f8",
"path": "/health",
"methods": ["GET", "HEAD"],
"signature": null,
"created_at": "2026-11-12T09:01:00Z",
"updated_at": "2026-11-12T09:01:00Z"
}
]
}
Was this helpful?