Client-side fetch paths resolve to server routes

A client that fetches /api/user/profile when the server only defines /api/users/me returns 404 on every call in production — and AI tools are specifically prone to inventing plausible-sounding endpoints that do not exist. The user sees a loading spinner that never resolves, or a silent data-load failure that reads as a blank page. This is reference-integrity at the API boundary and it aligns directly with OWASP A05 (Security Misconfiguration) when the 404 exposes stack traces.

For each unresolved URL, either create the missing route handler or correct the client specifier. In Next.js App Router, the handler lives next to the URL path in app/api/...:

// app/api/user/profile/route.ts
export async function GET() {
  return Response.json({ /* ... */ })
}

If you route through next.config.* rewrites, verify the rewrite source matches the fetch specifier exactly.