Actual error behavior

401 — unauthorized

{"success":false,"code":"unauthorized","message":"Invalid or missing API key."}

Missing/invalid Bearer key. The guard runs before protected route matching, so an unknown path also returns 401. Do not infer route existence or successful schema validation from 401.

404 — authenticated unknown path or method

{"success":false,"message":"Endpoint not found"}

Observed with an authorized GET to the old /wp-json/gath/v1/services. This is not a WordPress rest_no_route response. Do not try production writes to discover a contract.

204 — preflight only

OPTIONS is generic and does not enumerate implemented methods. The advertised POST is not a write API contract.

Data and operational limits

Empty rates can mean no matches or a failed data-file read; health alone cannot distinguish these cases. No rate-limit, pagination or formal validation error contract is implemented in this handler. For network/TLS failures, preserve the actual status and sanitized body; contact GATH rather than substituting sample success data.

实际错误行为

401 — unauthorized

{"success":false,"code":"unauthorized","message":"Invalid or missing API key."}

缺失或无效 Bearer 密钥。认证先于受保护路由匹配，因此未知路径也返回 401；不能据此证明路由存在或请求字段通过校验。

404 — 已鉴权但路径或方法不匹配

{"success":false,"message":"Endpoint not found"}

已授权 GET 旧 /wp-json/gath/v1/services 实测如此。这不是 WordPress 的 rest_no_route 响应。不要通过生产写请求猜测契约。

204 — 仅预检

OPTIONS 是通用响应，不列举真正实现的方法；广告 POST 不等于已实现写 API。

数据及运行边界

空运价可能是无匹配，也可能是数据文件读取失败；health 无法区分。当前处理器未实现限流、分页或正式的字段校验错误契约。网络/TLS 失败应保留真实状态及脱敏响应，联系 GATH，不要用样例成功数据替代。