# Feature catalog — strapi/strapi

> Canonical page: https://codevetter.com/unpack/strapi/feature-catalog

# Feature catalog — strapi/strapi

Scanned commit 93476f908c08d6d3d5215c06483829e3c6da1b32 (2026-10-02). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The inspected surfaces support model-driven APIs, browser editing, publication/localization, identity management, and media operations. Optional GraphQL and licensed editorial capabilities extend the base CMS. CLI commands cover application operation and data movement, while MCP provides a separate authenticated automation surface. These eight capability groups describe the inspected implementation; the bounded inventory is not an exhaustive screen or route catalog.
- Generated REST routes distinguish singular single types from plural collection types and expose read/write operations with request/response schemas. The GraphQL plugin builds a Content API schema and initializes Apollo only when that schema is nonempty. — [packages/core/core/src/core-api/routes/index.ts#L23-64](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/core-api/routes/index.ts#L23-L64) [packages/core/core/src/core-api/routes/index.ts#L67-129](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/core-api/routes/index.ts#L67-L129) [packages/plugins/graphql/server/src/bootstrap.ts#L140-152](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/plugins/graphql/server/src/bootstrap.ts#L140-L152) [packages/plugins/graphql/server/src/bootstrap.ts#L203-236](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/plugins/graphql/server/src/bootstrap.ts#L203-L236)
- Content Manager registers a navigation entry and content-manager/* routes for collection lists, single/collection editing, cloning, list/edit/component configuration, permission errors, history, and preview. Document action UI exposes save and publish shortcut hints. — [packages/core/content-manager/admin/src/index.ts#L18-46](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/content-manager/admin/src/index.ts#L18-L46) [packages/core/content-manager/admin/src/router.tsx#L38-95](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/content-manager/admin/src/router.tsx#L38-L95) [packages/core/content-manager/admin/src/pages/EditView/components/DocumentActions.tsx#L251-278](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/content-manager/admin/src/pages/EditView/components/DocumentActions.tsx#L251-L278)
- Content-Type Builder exposes admin endpoints to list, inspect, create, update, and delete content types and create components. Mutation routes combine admin permission policies with isDevelopmentMode middleware. — [packages/core/content-type-builder/server/src/routes/admin.ts#L19-85](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/content-type-builder/server/src/routes/admin.ts#L19-L85) [packages/core/content-type-builder/server/src/routes/admin.ts#L87-124](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/content-type-builder/server/src/routes/admin.ts#L87-L124)
- Document Service supports create, clone, update, delete, count, and reads; publish/unpublish/discardDraft are exposed only for draft-and-publish types. Localized operations apply a default locale, and multi-locale lookup accepts '*' to avoid selecting a single locale. — [packages/core/core/src/services/document-service/repository.ts#L776-790](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/services/document-service/repository.ts#L776-L790) [packages/core/core/src/services/document-service/internationalization.ts#L19-28](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/services/document-service/internationalization.ts#L19-L28) [packages/core/core/src/services/document-service/internationalization.ts#L54-67](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/services/document-service/internationalization.ts#L54-L67)
- Users & Permissions provides local login/registration and provider callbacks. Login rejects disabled providers, invalid passwords, unconfirmed accounts when confirmation is required, and blocked users; refresh mode supports session responses, while session-list tests specify authentication and current-session display behavior. — [packages/plugins/users-permissions/server/src/routes/content-api/auth.js#L18-47](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/plugins/users-permissions/server/src/routes/content-api/auth.js#L18-L47) [packages/plugins/users-permissions/server/src/controllers/auth.js#L139-203](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/plugins/users-permissions/server/src/controllers/auth.js#L139-L203) [packages/plugins/users-permissions/server/src/controllers/__tests__/auth-sessions.test.js#L52-125](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/plugins/users-permissions/server/src/controllers/__tests__/auth-sessions.test.js#L52-L125)
- Media permissions cover upload, crop/details/replace/delete, download, copy-link, and view configuration. Provider adapters support streams or buffers; inspected implementations include local filesystem storage, AWS S3 SDK integration, and Cloudinary stream/chunked uploads. — [packages/core/upload/server/src/bootstrap.ts#L75-115](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/upload/server/src/bootstrap.ts#L75-L115) [packages/core/upload/server/src/services/provider.ts#L13-32](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/upload/server/src/services/provider.ts#L13-L32) [packages/providers/upload-local/src/index.ts#L80-120](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/providers/upload-local/src/index.ts#L80-L120) [packages/providers/upload-aws-s3/src/index.ts#L3-21](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/providers/upload-aws-s3/src/index.ts#L3-L21) [packages/providers/upload-cloudinary/src/index.ts#L27-56](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/providers/upload-cloudinary/src/index.ts#L27-L56)
- Review Workflows and Content Releases expose their runtime modules under separate EE feature checks, retaining content types when disabled. Audit Logs routes/controllers require both admin.auditLogs.enabled and the audit-logs license feature; contributor docs describe filtered CSV export with read/export permissions. — [packages/core/review-workflows/server/src/index.ts#L9-26](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/review-workflows/server/src/index.ts#L9-L26) [packages/core/content-releases/server/src/index.ts#L10-28](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/content-releases/server/src/index.ts#L10-L28) [packages/core/admin/ee/server/src/index.ts#L24-45](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/admin/ee/server/src/index.ts#L24-L45) [docs/docs/docs/01-core/admin/01-ee/02-audit-logs.md#L43-47](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/docs/docs/docs/01-core/admin/01-ee/02-audit-logs.md#L43-L47)
- CLI factories cover admin-user management, configuration dump/restore, diagnostics, generation, build/develop/start, import/export/transfer, OpenAPI, and cloud commands; exports support tar or unpacked directories. Automation also includes configured cron tasks, event-driven webhooks, and MCP tool/prompt/resource registration. — [packages/core/strapi/src/cli/commands/index.ts#L37-72](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/strapi/src/cli/commands/index.ts#L37-L72) [packages/core/strapi/src/cli/commands/export/command.ts#L20-59](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/strapi/src/cli/commands/export/command.ts#L20-L59) [packages/core/core/src/providers/cron.ts#L8-17](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/providers/cron.ts#L8-L17) [packages/core/core/src/services/webhook-runner.ts#L85-130](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/services/webhook-runner.ts#L85-L130) [packages/core/core/src/services/mcp/index.ts#L66-85](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/services/mcp/index.ts#L66-L85)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)