1# API Routes
2 
3## Auth Check Pattern
4 
5```typescript
6import { auth } from '@clerk/nextjs/server';
7 
8export async function GET() {
9  const { isAuthenticated, userId } = await auth();
10  if (!isAuthenticated) {
11    return Response.json({ error: 'Unauthorized' }, { status: 401 });
12  }
13  const data = await db.data.findMany({ where: { userId } });
14  return Response.json(data);
15}
16```
17 
18> **Core 2 ONLY (skip if current SDK):** `isAuthenticated` is not available. Use `if (!userId)` instead.
19 
20## 401 vs 403
21 
22- **401** - Not authenticated
23- **403** - Authenticated but lacks permission
24 
25```typescript
26export async function DELETE(req: Request) {
27  const { isAuthenticated, has } = await auth();
28  if (!isAuthenticated) return Response.json({ error: 'Unauthorized' }, { status: 401 });
29 
30  const isAdmin = await has({ role: 'org:admin' });
31  if (!isAdmin) return Response.json({ error: 'Forbidden' }, { status: 403 });
32 
33  return Response.json({ success: true });
34}
35```
36 
37## Org Route Protection
38 
39```typescript
40export async function GET(req: Request, { params }: { params: { orgId: string } }) {
41  const { userId, orgId } = await auth();
42  if (!userId) return Response.json({ error: 'Unauthorized' }, { status: 401 });
43  if (orgId !== params.orgId) return Response.json({ error: 'Forbidden' }, { status: 403 });
44 
45  const orgData = await db.orgs.findUnique({ where: { id: orgId } });
46  return Response.json(orgData);
47}
48```
49 
50[Docs](https://clerk.com/docs/reference/nextjs/auth)
51