Internal Admin Endpoints

Reepolee keeps its operational endpoints disabled by default. Enable them only when an operator or automation needs to reload translations or inspect and reset rate-limit counters.

Set both variables in the deployment environment:

INTERNAL_ADMIN_ENDPOINTS=true
RELOAD_SECRET="a-random-secret-at-least-32-characters-long"

Every request must send the secret in X-Reload-Secret. When endpoints are disabled, they return 404; with a missing, short, or incorrect secret, they return 401.

Do not publish these endpoints to untrusted users. Put them behind your normal network and reverse-proxy controls, keep the secret outside version control, and rotate it if it may have been exposed.

Translation Reload

POST /__reload-translations reloads the database-backed translations, rebuilds localized route maps, and notifies connected live-reload clients in development.

curl -X POST http://localhost:2338/__reload-translations \
    -H "X-Reload-Secret: $RELOAD_SECRET"

Use it after a process writes translations outside the built-in admin UI or generator workflow. A successful call responds with 200 OK.

Rate-limit Diagnostics

GET /__rate-limits returns a JSON summary of active rate-limit windows by scope, including each scope's limit, window, number of identities, and total requests.

curl http://localhost:2338/__rate-limits \
    -H "X-Reload-Secret: $RELOAD_SECRET"

POST /__reset-rate-limits deletes the active rate-limit counters and returns the number of deleted keys:

curl -X POST http://localhost:2338/__reset-rate-limits \
    -H "X-Reload-Secret: $RELOAD_SECRET"

Resetting counters is an operational action, not a routine application request. Use it for maintenance or to clear a test condition, and expect clients to receive a fresh limit window afterwards.

The endpoints return 503 when the rate-limit store is unavailable, for example when Redis is down. See Rate Limiting for the configuration and middleware behavior.