> ## Documentation Index
> Fetch the complete documentation index at: https://docs.asobeast.com/llms.txt
> Use this file to discover all available pages before exploring further.

# The queue dashboard and the OpenAPI surface

> The queue dashboard and the OpenAPI routes answer 404 to anyone who is not a signed in owner, because the surface does not confirm it exists.

Two administrative surfaces ship with asobeast: the queue dashboard at `/admin/queues` and the OpenAPI surface at `/docs`. Both answer `404` to anyone who is not a signed in owner.

## Why 404 and not 403?

A `403` confirms that the thing you asked for exists. A `404` does not.

Anonymous callers therefore get the same answer whether the surface is present, disabled or was never built. There is no login prompt to attack, and a scanner learns nothing from the response.

If you expected a sign in page on `/admin/queues` and got a not found page, nothing is broken. Sign in as the owner in the same browser and reload.

## The queue dashboard

`/admin/queues` serves Bull Board, which shows every queue, its waiting, active, completed and failed jobs, and lets an owner retry a failed job.

| Setting              | Default | Effect                                 |
| -------------------- | ------- | -------------------------------------- |
| `BULL_BOARD_ENABLED` | `true`  | `false` removes the dashboard entirely |

The owner gate is unconditional. There is no configuration that opens the queue dashboard to anonymous callers.

## The OpenAPI surface

`API_DOCS` controls who may read `/docs`, `/docs-json` and `/docs-yaml`.

| Value    | Behaviour                                                                                      |
| -------- | ---------------------------------------------------------------------------------------------- |
| `owner`  | Default. Requires an owner session or an owner personal API token, and answers `404` otherwise |
| `public` | Serves the documentation and the OpenAPI document to anyone                                    |
| `off`    | Never registers the routes at all                                                              |

`public` is a deliberate choice, not an accident, and it is reasonable when the API surface is meant to be read by people you have not given accounts to.

## Both are reached through the web origin

You never reach either surface on the API port. The web app serves route handlers at the identical paths and proxies them through.

Identical paths matter: both surfaces are single page applications that build their asset URLs from the path they are mounted on, so serving `/admin/queues` at any other path breaks its own assets.

The gate itself runs before the application framework's guards, because both surfaces register their own routing outside them. It resolves the session cookie or the `asob_` token itself, and the queue dashboard re asserts the grant afterwards, so a deployment that forgot the wiring fails closed rather than open.

## Retired variables

`BULL_BOARD_USER` and `BULL_BOARD_PASSWORD` are ignored. The dashboard used to use basic authentication and now requires an owner session or a personal API token instead.

The API logs a warning at boot if either is still set. Remove them from your environment.

## Related

<CardGroup cols={2}>
  <Card title="Personal API tokens" icon="key-round" href="/security/api-tokens">
    An owner token reaches both surfaces.
  </Card>

  <Card title="Health checks and monitoring" icon="activity" href="/operations/health-checks">
    Queue health without opening the dashboard.
  </Card>
</CardGroup>