> ## Documentation Index
> Fetch the complete documentation index at: https://docs.turbostack.io/llms.txt
> Use this file to discover all available pages before exploring further.

# API Routes

> At the end of this tutorial, you'll be able to create new API Routes for your application.

Any file named `route.ts` in the <Icon icon="folder" iconType="solid" /> **/apps/web/app/api** is an [API Route](https://nextjs.org/docs/app/building-your-application/routing).

Here's an example of an API Route that perform a Hello World:

```ts theme={null}
export async function GET() {
  return NextResponse.json({
    message: 'Hello World'
  })
}
```

## Protected API Route

To create a protected api route, you need to decorate the example above with the `withSession` helper:

```ts theme={null}
export const GET = withSession(async ({ session }) => {
  return NextResponse.json({
    message: `Hello World from ${session.user.name}`
  })
})
```

## Project-based Protected API Route

To create an api route that refers to a given project and not the authenticated user, use the `withAuth` helper:

```ts theme={null}
export const GET = withAuth(async ({ project, req, session }) => {
  return NextResponse.json({
    message: `
      Hello World from ${session.user.name}, 
      member of ${project.name} project
    `
  }) 
})
```

## Role Protection

`withAuth` accepts a second optional argument with the following structure:

```ts theme={null}
{
  requiredRole: ['owner']
}
```

We can add it to an api route to make it available only to the owner of the project:

```ts theme={null}
export const GET = withAuth(async ({ project, req, session }) => {
  return NextResponse.json({
    message: `
      Hello World from ${session.user.name}, 
      member of ${project.name} project
    `
  }) 
}, { requiredRole: ['owner'] })
```