Where the routes come from
The API is not written by hand, table by table. The database schema is the source. The schema is one file per database schema, and when the backend starts it walks them. Each table that is exposed gets an address of the form /<schema>/<table>, with list, create, read, update and delete, checked against the table's own validation and served at the table's exposure tier. Routes that need more than a table can say on its own, like Projects, are written by hand and mounted beside them.
From both, the backend assembles one OpenAPI document and serves it. The test suite fails if a route the backend serves is missing from that document. The toolkit reads the document and writes the SDKs, and the help site reads it and writes the REST reference. That is why the reference, the SDKs and the server cannot drift apart.
The backend refuses to start if the pieces disagree: a table with no exposure tier, a sync entry that names a table which does not exist, or a feature area missing from the list that authorization reads.