start project

backend/config/urls.py

@@ -25,16 +25,23 @@ api_v1 = [
 urlpatterns = [
     path(getattr(settings, "ADMIN_URL", "admin/"), admin.site.urls),
     path("api/v1/", include((api_v1, "api"), namespace="v1")),
-    # OpenAPI schema and the two documentation renderers.
-    path("api/schema/", SpectacularAPIView.as_view(), name="schema"),
-    path(
-        "api/docs/",
-        SpectacularSwaggerView.as_view(url_name="schema"),
-        name="swagger-ui",
-    ),
-    path("api/redoc/", SpectacularRedocView.as_view(url_name="schema"), name="redoc"),
 ]
 
+# OpenAPI schema and the two documentation renderers.  They are served without
+# authentication, and together they document every endpoint, parameter and
+# response shape in the service - useful everywhere except on a public
+# production origin, where SERVE_API_DOCS defaults to false.
+if getattr(settings, "SERVE_API_DOCS", True):
+    urlpatterns += [
+        path("api/schema/", SpectacularAPIView.as_view(), name="schema"),
+        path(
+            "api/docs/",
+            SpectacularSwaggerView.as_view(url_name="schema"),
+            name="swagger-ui",
+        ),
+        path("api/redoc/", SpectacularRedocView.as_view(url_name="schema"), name="redoc"),
+    ]
+
 admin.site.site_header = "LinkedIn Profile Search"
 admin.site.site_title = "LinkedIn Profile Search"
 admin.site.index_title = "Operations"