# Routing

Map public content, APIs, WebSockets, and streams to the exact Ferrite binding that may serve them.

Routes connect a public path to one declared application binding. The Gateway
terminates HTTP and TLS, applies limits and security policy, then projects the
request into content, API, WebSocket, or server-sent event behavior.

## Declare routes

```json filename="ferrite.json"
{
  "services": [
    { "name": "requests", "primitive": "queue" },
    { "name": "updates", "primitive": "queue" },
    { "name": "sessions", "primitive": "queue" },
    { "name": "web-assets", "primitive": "blob" }
  ],
  "applications": [{
    "name": "storefront",
    "artifact_key": "apps/storefront@v1",
    "artifact_sha256": "0000000000000000000000000000000000000000000000000000000000000000",
    "bindings": [
      { "handle": "requests", "kind": "queue", "service": "requests" },
      { "handle": "updates", "kind": "queue", "service": "updates" },
      { "handle": "sessions", "kind": "queue", "service": "sessions" },
      { "handle": "web-assets", "kind": "blob", "service": "web-assets" }
    ],
    "routes": [
      { "prefix": "/api/", "binding": "requests", "kind": "api" },
      { "prefix": "/events", "binding": "updates", "kind": "stream" },
      { "prefix": "/socket", "binding": "sessions", "kind": "ws" },
      {
        "prefix": "/",
        "binding": "web-assets",
        "kind": "content",
        "key_prefix": "site/",
        "public": true
      }
    ]
  }]
}
```

Use the most specific API paths before a catch-all content route. Forward only
headers your application actually needs, such as `accept`,
`mcp-protocol-version`, or a provider signature header.

## Route security

You can attach a per-minute token bucket to each API route with
`rate_limit_per_min`. Secure response headers and cookies are emitted through
the response metadata contract rather than string-concatenated by a proxy.
Unknown bindings and undeclared forwarded request headers fail closed.

Public content routes can serve an Astro or Vite build from Object Storage.
API routes use request/reply queues, allowing the Gateway and function tier to
scale independently.

See [Rate Limits](/developers/rate-limits/), [Headers & Cookies](/developers/headers-cookies/),
and [Webhooks](/developers/webhooks/).