# Data flow — strapi/strapi

> Canonical page: https://codevetter.com/unpack/strapi/data-flow

# Data flow — strapi/strapi

Scanned commit 93476f908c08d6d3d5215c06483829e3c6da1b32 (2026-10-02). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

HTTP data crosses authentication and policy boundaries before controller validation and sanitization. The Document Service translates document parameters into locale/status-specific database operations and owns transaction coordination. Media bytes, metadata, session state, and event payloads have distinct persistence/output boundaries. Browser state and MCP transport responses follow separate paths from ordinary REST response handling.
- Endpoint composition attaches route information, authenticates, authorizes, runs policies and route middleware, then invokes the controller. returnBodyMiddleware copies a returned value into ctx.body only when the controller has not already set a body. — [packages/core/core/src/services/server/compose-endpoint.ts#L64-95](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/services/server/compose-endpoint.ts#L64-L95)
- Collection create requires an object body.data, validates/sanitizes query and input, delegates to the content service, sanitizes the returned entity, and sets 201. Base controller sanitizers receive request auth; REST strict-parameter configuration is passed into validation options. — [packages/core/core/src/core-api/controller/collection-type.ts#L50-72](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/core-api/controller/collection-type.ts#L50-L72) [packages/core/core/src/core-api/controller/index.ts#L15-26](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/core-api/controller/index.ts#L15-L26) [packages/core/core/src/core-api/controller/index.ts#L51-70](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/core-api/controller/index.ts#L51-L70)
- Collection services default fetch parameters to status:'published', whereas Document Service findMany applies defaultToDraft before status/locale lookup and query translation. API reads and direct Document Service reads therefore have different defaults. — [packages/core/core/src/core-api/service/core-service.ts#L1-7](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/core-api/service/core-service.ts#L1-L7) [packages/core/core/src/core-api/service/collection-type.ts#L24-35](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/core-api/service/collection-type.ts#L24-L35) [packages/core/core/src/services/document-service/repository.ts#L328-340](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/services/document-service/repository.ts#L328-L340) [packages/core/core/src/services/document-service/draft-and-publish.ts#L28-34](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/services/document-service/draft-and-publish.ts#L28-L34)
- transformParamsToQuery allowlists query parameters, merges internal lookup into where, removes publication-only top-level parameters, and expresses publication filtering through query.filters so nested populate queries receive cohort conditions using their own model UID. — [packages/core/core/src/services/document-service/transform/query.ts#L14-43](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/services/document-service/transform/query.ts#L14-L43) [packages/core/core/src/services/document-service/transform/query.ts#L44-84](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/services/document-service/transform/query.ts#L44-L84)
- Entry creation validates entity data, creates/assigns components, applies attribute transforms, and writes through db.query(uid).create. Database creation processes defaults, inserts a row, attaches relations, rereads selected/populated output, and runs afterCreate lifecycles. — [packages/core/core/src/services/document-service/entries.ts#L92-111](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/services/document-service/entries.ts#L92-L111) [packages/core/database/src/entity-manager/index.ts#L332-372](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/database/src/entity-manager/index.ts#L332-L372)
- Document events register an onCommit callback, then reload/populate applicable entries, sanitize the payload, and emit through eventHub. Webhook listeners enqueue those events and POST JSON with configured headers and a ten-second abort timeout. — [packages/core/core/src/services/document-service/events.ts#L27-57](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/services/document-service/events.ts#L27-L57) [packages/core/core/src/services/webhook-runner.ts#L85-130](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/services/webhook-runner.ts#L85-L130)
- Uploads validate/enhance inputs and write provider bytes before creating FILE_MODEL_UID metadata and emitting MEDIA_CREATE; temporary working directories are removed in finally. Read methods sign file URLs through fileService for private-provider output. — [packages/core/upload/server/src/services/upload.ts#L255-289](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/upload/server/src/services/upload.ts#L255-L289) [packages/core/upload/server/src/services/upload.ts#L424-441](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/upload/server/src/services/upload.ts#L424-L441) [packages/core/upload/server/src/services/upload.ts#L575-617](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/upload/server/src/services/upload.ts#L575-L617)
- Refresh-token generation persists active session records with origin, user/device identity, idle expiry, and absolute expiry before signing JWTs. MCP independently authenticates an admin bearer token, installs user/auditSource context, and hands the request to a per-request transport that writes directly to the HTTP response. — [packages/core/core/src/services/session-manager.ts#L323-395](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/services/session-manager.ts#L323-L395) [packages/core/core/src/services/session-manager.ts#L70-91](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/services/session-manager.ts#L70-L91) [packages/core/core/src/services/mcp/authentication.ts#L34-59](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/services/mcp/authentication.ts#L34-L59) [packages/core/core/src/services/mcp/handlers/handlePost.ts#L22-74](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/services/mcp/handlers/handlePost.ts#L22-L74)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)