The gateway's self-registered endpoints (/docs, /search, /developer, /sdk, /admin, etc.; most require a JWT or the admin role) are registered inside the gateway process and are not under the /bff prefix; the specification below documents the gateway's own management-plane endpoints.