First protected app / Step 3 of 6
Discover your routes
Source and package versions
One AIWAF repository.
Python: py/aiwaf/ · Node.js: js/ · Rust/WASM: rust/ · Java: java/.
Source and canonical README.
Versions shown describe the source checkout; package releases are independent.
Current Python/Node source targets are aiwaf 1.1.8 (Python) and
aiwaf 1.1.5 (npm), with Rust/Python 0.2.7 and
WASM 0.2.5 and Java 1.3.5. Sandbox guides retain their separately pinned builds.
Route discovery records the routes your application actually registers. It does not create handlers or launch a permanent server. AIWAF can use the generated manifest when building route policy.
1. Import the live application
Open a second terminal in aiwaf-demo, activate the same environment, and run:
aiwaf init --framework flask --app app:appapp:app means “import the module app.py, then read its app object.” A file path such as --app app.py is invalid. If your application uses a factory, use its import target, such as app:create_app.
2. Inspect the manifest
python -m json.tool .aiwaf/paths.jsonYou should see a JSON document with schema metadata and a routes collection containing /api/message and /health. Flask's static route may also appear. Counts and context hashes depend on the registered application; they are not fixed tutorial constants.
The manifest includes inferred protections, not just path names. An API route may receive a suggested rate budget such as 120 requests per minute. The explicit /api/message rule in app.py takes precedence for that same prefix, keeping the tutorial limit at three. Review inferred settings before using a generated manifest in an existing app.
3. Check the imported route table
If your routes are missing, inspect the module the command is loading:
python -c "import app; print(app.__file__); print(*sorted(r.rule for r in app.app.url_map.iter_rules()), sep='\n')"The file should be the app.py you just created, and the route list should include both handlers. An unregistered blueprint or a different module named app cannot contribute the intended routes.
4. Know when to regenerate
Regenerate after adding, removing, or changing routes. Restart the development server after generation so later requests use the updated manifest. CLI discovery imports your app and requires its dependencies and configuration to be available.