# Auditing

`auth_surface(app)` lists every route with what guards it, including routes hidden from the OpenAPI schema:

```python
from fastapi import FastAPI

from fastapi_multiauth import auth_surface


def print_surface(app: FastAPI) -> None:
    for route in auth_surface(app):
        methods = ",".join(route.methods) or "WS"
        flag = "UNGUARDED" if route.unguarded else ""
        print(f"{methods:8} {route.path:30} {flag}")
```

Each `RouteAuth` tells you:

**`unguarded`**

`True` when a request without any credential reaches the route.

**`alternatives`**

The ways in. Each entry is one way (OR); the schemes inside an entry must all pass (AND).

**`scopes`**

Every scope named on the route.

Each `SchemeRequirement` in `alternatives` also says whether it refuses cross-origin requests: `csrf` is `False` for a cookie source without [`csrf=True`](<https://fastapi-multiauth.d3vyce.fr/guide/cookie-sessions/#csrf>).

To fail CI on an unguarded route, see the [audit recipe](<https://fastapi-multiauth.d3vyce.fr/recipes/audit-routes/index.md>).