pub async fn api_root(
headers: HeaderMap,
__arg1: State<SharedState>,
) -> ApiResult<Json<ApiRunning>>Expand description
GET /api/ — the HA APIStatusView (“API running.” ping).
Security (HC-API-AUTH-01): HA’s APIStatusView inherits
requires_auth = True from HomeAssistantView, so an unauthenticated
(or wrong-token) request to /api/ returns 401, not 200. HA
clients (and the companion app) rely on this status route as a
token-validation probe — a 200 here would tell a client a bad token
is good, and would let an unauthenticated party confirm a live
HOMECORE-API endpoint. The P2 handler skipped the bearer gate that
every sibling route applies; this restores wire-compat by validating
the bearer like get_config/get_states before replying.