Tell what http methods / endpoints are available

[sorenmalling]

From reading and trying the code, all HTTP Methods (and therefore actions) are available.

You can override the endpoint and return 404, but rather defined what actions are available

@albe Perhaps you can give insigts on how this could be done concept-wise?

[albe]

Yes indeed, limiting the CRUD actions configuratively was not in the concept of this. The idea is/was, that any entity that you make public via API should be fully editable by default and for the few rare cases where you e.g. don't want to allow deletion, you just override the deleteAction() (or w/e) and throw a 404 from there, so that it's explicit in the controller what is not allowed.

Technically, it would be possible to make the resolveActionMethodName() configurable. Either by injecting some settings where you could exclude actions per controller name, or maybe via a custom annotation on the controller that could be statically reflected on. Fortunately Flow is a very nice framework providing flexible options on achieving such things.

[sorenmalling]

With the signal introduced with the @Route annotation, we might be able to this less "homemade" :)