# K1 HTTP audio
`authenticated_routes(Arc<K1AccessFullAudio>) -> axum::Router<()>` returns listener-free authenticated audio routes for nesting below K1Http's `/api`.
Routes are:
- `POST /audio/profiles/{profile_id}` submits the signed raw-media body with the caller's saved access profile.
- `GET /audio` and `GET /audio/groups/{group_id}` return monotonic Access ID discovery.
- `GET /audio/{access_id}` returns current-authorized full-audio and fragment status.
- `GET /audio/{access_id}/fragments/{fragment_id}/audio` returns the exact authorized Ogg fragment.
- `PUT /audio/{access_id}/fragments/{fragment_id}/labels` submits complete known/Unknown labels.
- `POST /audio/{access_id}/fragments/{fragment_id}/retry` and `/discard` apply those existing actions.
Every route requires K1Http authentication. The adapter immediately converts the authenticated identity to `UserId`; requests never contain model IDs or provider choices. Model selection and model authorization remain inside `K1AccessFullAudio`. IDs are canonical lowercase hexadecimal. Upload uses `application/octet-stream`; labels use `application/json`. Synchronous facade calls run through Tokio blocking tasks.
The package owns no listener, authentication protocol, provider, state, retry policy, queue, timeout, body-size limit, concurrency limit, model selection, Person lookup, browser behavior, or deployment behavior. K1Http retains signed-body collection and its configured limit. Responses are not cached.
Version 0.1.1 only aligns these dependencies for daemon composition.