This page is an index of the API surface with the file that defines each member. It reflects lib/ at version 5.2.1; behavior details live in the linked how-it-works pages and, authoritatively, in the test file named after each member.

Module exports (lib/express.js)

The module itself is createApplication. Attached to it:

Export Source
express() createApplication in lib/express.js
express.application, express.request, express.response the three prototypes, exposed for extension
express.Router, express.Route re-exported from the router package
express.json, express.raw, express.text, express.urlencoded re-exported from body-parser
express.static re-exported from serve-static

test/exports.js pins this list, including that express.request has http.IncomingMessage.prototype in its chain and that a bare app "should permit modifying the .application prototype".

app (lib/application.js)

Member Notes
app.listen(...) http.createServer(this) plus error-aware callback wrapping
app.use([path], ...fns) middleware and sub-app mounting; arrays flattened to any depth
app.METHOD(path, ...handlers) one method per entry in Node's http.METHODS (get, post, put, delete, query, ...)
app.get(key) / app.get(path, ...) one argument reads a setting; otherwise registers a GET route
app.all(path, ...handlers) registers on every method
app.route(path) returns a chainable Route
app.param(name or names[], fn) param callbacks; array form handled in this repo
app.set / app.enable / app.disable / app.enabled / app.disabled settings (reference)
app.engine(ext, fn) register a template engine
app.render(name, opts, cb) render without responding
app.path() absolute mount path (/blog/admin when nested)
app.locals render-time locals object; app.locals.settings aliases the settings
app.mountpath, app.parent, on('mount') mounting surface
app.request, app.response per-app prototypes applied to each req/res
app.router lazy base router (getter)
app.handle(req, res, next) dispatch entry, called by the app function itself

req (lib/request.js)

Methods: req.get(name)/req.header(name) (Referer/Referrer interchangeable), req.accepts, req.acceptsEncodings, req.acceptsCharsets, req.acceptsLanguages, req.range(size, opts), req.is(types).

Getters: req.query, req.protocol, req.secure, req.ip, req.ips, req.subdomains, req.path, req.host, req.hostname, req.fresh, req.stale, req.xhr.

Set by the framework during dispatch rather than defined on the prototype: req.app, req.res, req.params, req.baseUrl, req.route, req.next. Set only by middleware, never by core: req.body (body-parser), req.cookies/req.signedCookies/req.secret (cookie-parser).

res (lib/response.js)

Group Members
Body res.send, res.json, res.jsonp, res.sendStatus, res.end (inherited)
Files res.sendFile, res.download, res.attachment
Headers res.set/res.header, res.get, res.append, res.type/res.contentType, res.vary, res.links
Status res.status(code) -- throws TypeError/RangeError outside integer 100-999
Cookies res.cookie, res.clearCookie
Redirects res.redirect([status], url), res.location(url)
Negotiation res.format(obj)
Rendering res.render(view, [locals], [cb]), res.locals
Wiring res.app, res.req

Stability boundaries

Three practical notes on what is and is not API:

  • Route pattern syntax is not defined in this repo. :param, *splat, and {optional} come from router/path-to-regexp; consult that package for matching semantics (why).
  • Prototype extension is supported. express.request/express.response (module-wide) and app.request/app.response (per app) are documented extension points, with tests in test/app.request.js and test/app.response.js.
  • Anything not exported from lib/express.js is internal. lib/utils.js and lib/view.js are require()-able but undocumented internals; the view setting is the sanctioned way to swap view behavior.

Sources: lib/express.js, lib/application.js, lib/request.js, lib/response.js · last synced 2026-07-27 · a371447 · version 5.2.1