# K1 HTTP audio
`authenticated_routes(Arc<K1AccessFullAudio>) -> axum::Router<()>` returns listener-free authenticated audio routes for nesting below K1Http's `/api`.
Routes are:
- `POST /audio/profiles/{profile_id}` submits the signed raw-media body with the caller's saved access profile.
- `GET /audio` and `GET /audio/groups/{group_id}` return monotonic Access ID discovery.
- `GET /audio/{access_id}` returns current-authorized full-audio and fragment status.
- `GET /audio/{access_id}/fragments/{fragment_id}/audio` returns the exact authorized Ogg fragment.
- `PUT /audio/{access_id}/fragments/{fragment_id}/labels` submits complete known/Unknown labels.
- `POST /audio/{access_id}/fragments/{fragment_id}/retry` and `/discard` apply those existing actions.
Every route requires K1Http authentication. The adapter immediately converts the authenticated identity to `UserId`; requests never contain model IDs or provider choices. Model selection and model authorization remain inside `K1AccessFullAudio`. IDs are canonical lowercase hexadecimal. Upload uses `application/octet-stream`; labels use `application/json`. Synchronous facade calls run through Tokio blocking tasks.
The package owns no listener, authentication protocol, provider, state, retry policy, queue, timeout, body-size limit, concurrency limit, model selection, Person lookup, browser behavior, or deployment behavior. K1Http retains signed-body collection and its configured limit. Axum's implicit 2 MiB extractor limit is disabled only for the upload route, after authentication, so it cannot reject an already collected signed upload. Responses are not cached.
Version 0.1.2 disables Axum's default body limit only on signed uploads; K1Http remains the configured body-limit owner.