121 endpoints across 21 areas of the control plane: certificate issuance and renewal, CA health, discovery, deployment, and host agents. Each endpoint table gives the role required to call it.
Four roles, held in CertPilot's own table rather than read from a token claim, so an identity provider cannot grant or change them.