snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/server/api/v1/setupWizard.ts

@@ -0,0 +1,38 @@
+import { ajv, validateBadRequestErrorResponse, validateForbiddenErrorResponse } from '@rocket.chat/rest-typings';
+
+import type { SetupWizardParameters } from '../../lib/getSetupWizardParameters';
+import { getSetupWizardParameters, isSetupWizardCompleted } from '../../lib/getSetupWizardParameters';
+import { API } from '../api';
+
+const setupWizardParametersResponseSchema = ajv.compile<SetupWizardParameters>({
+	type: 'object',
+	properties: {
+		settings: { type: 'array', items: { type: 'object' } },
+		serverAlreadyRegistered: { type: 'boolean' },
+		success: { type: 'boolean', enum: [true] },
+	},
+	required: ['settings', 'serverAlreadyRegistered', 'success'],
+	additionalProperties: false,
+});
+
+// Unauthenticated on purpose: it feeds the setup wizard, which runs before the first admin exists.
+// That exception only holds until the wizard is completed; after that the settings it returns are no longer public.
+API.v1.get(
+	'setupWizard.parameters',
+	{
+		authRequired: false,
+		rateLimiterOptions: { intervalTimeInMS: 60000, numRequestsAllowed: 20 },
+		response: {
+			200: setupWizardParametersResponseSchema,
+			400: validateBadRequestErrorResponse,
+			403: validateForbiddenErrorResponse,
+		},
+	},
+	async function action() {
+		if (isSetupWizardCompleted()) {
+			return API.v1.forbidden();
+		}
+
+		return API.v1.success(await getSetupWizardParameters());
+	},
+);