diff --git a/src/App.vue b/src/App.vue
index 6565b05..c1a0a30 100644
--- a/src/App.vue
+++ b/src/App.vue
@@ -1,7 +1,8 @@
 <script setup lang="ts">
 import { ref } from 'vue'
 import { RouterView, useRouter } from 'vue-router'
-import { useAuth } from './composables/useAuth'
+import { useAuth, loginAvailable } from './composables/useAuth'
+import { searchAvailable } from './composables/useSearch'
 import UserMenu from './components/UserMenu.vue'
 import { getBaseUrl } from '@/composables/urlUtils.ts'
 
@@ -51,7 +52,12 @@ async function openAbout() {
           </span>
         </RouterLink>
 
-        <form class="header-search" role="search" @submit.prevent="submitSearch">
+        <form
+          v-if="searchAvailable"
+          class="header-search"
+          role="search"
+          @submit.prevent="submitSearch"
+        >
           <button type="submit" class="header-search__icon" aria-label="Search">
             <svg
               xmlns="http://www.w3.org/2000/svg"
@@ -101,9 +107,11 @@ async function openAbout() {
         </form>
 
         <nav class="app-header__nav">
-          <RouterLink v-if="!isLoggedIn" to="/login" class="header-login-btn">Log in</RouterLink>
+          <RouterLink v-if="loginAvailable && !isLoggedIn" to="/login" class="header-login-btn"
+            >Log in</RouterLink
+          >
 
-          <UserMenu v-else />
+          <UserMenu v-else-if="isLoggedIn" />
         </nav>
       </div>
     </header>
diff --git a/src/assets/main.css b/src/assets/main.css
index b004f73..de8a1f3 100644
--- a/src/assets/main.css
+++ b/src/assets/main.css
@@ -66,6 +66,12 @@ body {
   flex: 1;
 }
 
+/* Fallback shown when startup fails before Vue mounts. */
+.startup-error {
+  padding: var(--fdp-space-8);
+  color: var(--fdp-color-danger);
+}
+
 button,
 input,
 select,
diff --git a/src/components/UserMenu.vue b/src/components/UserMenu.vue
index 4dfd1a7..a61cbbf 100644
--- a/src/components/UserMenu.vue
+++ b/src/components/UserMenu.vue
@@ -1,7 +1,8 @@
 <script setup lang="ts">
 import { ref, onMounted, onUnmounted } from 'vue'
 import { RouterLink, useRouter } from 'vue-router'
-import { useAuth, avatarColor, userInitials } from '../composables/useAuth'
+import { useAuth, avatarColor, userInitials, getUserCurrentAvailable } from '../composables/useAuth'
+import { getUsersAvailable } from '../composables/useUsers'
 import IconUsers from '../assets/icons/users.svg?component'
 import IconUserEdit from '../assets/icons/user-edit.svg?component'
 import IconLogOut from '../assets/icons/log-out.svg?component'
@@ -61,7 +62,7 @@ onUnmounted(() => {
     </button>
 
     <div v-if="menuOpen" class="user-dropdown">
-      <template v-if="isAdmin">
+      <template v-if="isAdmin && getUsersAvailable">
         <div class="user-dropdown__section-header">FAIR Data Point</div>
         <RouterLink to="/users" class="user-dropdown__item" @click="menuOpen = false">
           <IconUsers />
@@ -72,7 +73,12 @@ onUnmounted(() => {
       <div class="user-dropdown__section-header">
         {{ user ? `${user.firstName} ${user.lastName}` : userEmail }}
       </div>
-      <RouterLink to="/users/current" class="user-dropdown__item" @click="menuOpen = false">
+      <RouterLink
+        v-if="getUserCurrentAvailable"
+        to="/users/current"
+        class="user-dropdown__item"
+        @click="menuOpen = false"
+      >
         <IconUserEdit />
         Edit profile
       </RouterLink>
diff --git a/src/composables/apiDocs.ts b/src/composables/apiDocs.ts
new file mode 100644
index 0000000..6d60b47
--- /dev/null
+++ b/src/composables/apiDocs.ts
@@ -0,0 +1,110 @@
+import { fetchRdfTurtle, fetchApiDocs } from './fdpApi'
+import { parseTurtle, resolveSubjectUri, getNodeRefs } from './rdfUtils'
+import { DCAT_ENDPOINT_DESCRIPTION } from './vocabularies'
+
+/**
+ * Returns candidate OpenAPI/SmartAPI document URLs from the FDP root. The spec defines
+ * dcat:endpointDescription on the root, and FDP 1.22+ may declare multiple values, such as both
+ * the OpenAPI document and Swagger UI. A /v3/api-docs guess is kept as the only path fallback for
+ * older or incomplete roots; callers still have to try the candidates.
+ */
+export async function discoverApiDocsUrls(rootUri: string): Promise<string[]> {
+  const store = parseTurtle(await fetchRdfTurtle(rootUri))
+  const subjectUri = resolveSubjectUri(store, rootUri)
+  const declaredUrls = subjectUri ? getNodeRefs(store, subjectUri, DCAT_ENDPOINT_DESCRIPTION) : []
+  const fallbackUrl = new URL('/v3/api-docs', rootUri).toString()
+  return [...new Set([...declaredUrls, fallbackUrl])]
+}
+
+type OpenApiOperation = { operationId?: string }
+type OpenApiDoc = { paths?: Record<string, Record<string, OpenApiOperation>> }
+
+function isOpenApiDoc(doc: unknown): doc is OpenApiDoc {
+  return typeof doc === 'object' && doc !== null && 'paths' in doc
+}
+
+let apiDocsPromise: Promise<unknown> | null = null
+
+/** Fetches the FDP's OpenAPI doc once per session and reuses it for all subsequent lookups. */
+async function getCachedApiDocs(rootUri: string): Promise<unknown> {
+  if (!apiDocsPromise) {
+    apiDocsPromise = resolveApiDocs(rootUri).catch((err) => {
+      apiDocsPromise = null
+      throw err
+    })
+  }
+  return apiDocsPromise
+}
+
+/**
+ * Fetches the FDP's OpenAPI document, trying each URL from discoverApiDocsUrls in turn and
+ * keeping the first one that actually parses as an OpenAPI document (has a paths object).
+ * Throws if none of the candidates resolve to one.
+ */
+async function resolveApiDocs(rootUri: string): Promise<unknown> {
+  const candidates = await discoverApiDocsUrls(rootUri)
+  for (const url of candidates) {
+    try {
+      const doc = await fetchApiDocs(url)
+      if (isOpenApiDoc(doc)) return doc
+    } catch {
+      // try the next candidate
+    }
+  }
+  throw new Error(`No usable OpenAPI document found among candidates: ${candidates.join(', ')}`)
+}
+
+/**
+ * Finds the path and HTTP method for a given operationId in an already-fetched OpenAPI document.
+ * Returns null if the document has no matching operation.
+ */
+export function resolveOperation(
+  doc: unknown,
+  operationId: string,
+): { path: string; method: string } | null {
+  const paths = (doc as OpenApiDoc | null)?.paths
+  if (!paths) return null
+
+  for (const [path, methods] of Object.entries(paths)) {
+    for (const [method, operation] of Object.entries(methods)) {
+      if (operation.operationId === operationId) {
+        return { path, method: method.toUpperCase() }
+      }
+    }
+  }
+
+  return null
+}
+
+export type OperationBinding = { url: string; method: string }
+
+/**
+ * Substitutes {name}-style placeholders in a path template with values from pathParams.
+ * @example substitutePathParams('/users/{uuid}', { uuid: 'abc' }) // -> '/users/abc'
+ */
+function substitutePathParams(path: string, pathParams: Record<string, string>): string {
+  return path.replace(/\{([^}]+)\}/g, (_placeholder, name: string) => {
+    const value = pathParams[name]
+    if (value === undefined) throw new Error(`Missing path parameter '${name}' for '${path}'`)
+    return encodeURIComponent(value)
+  })
+}
+
+/**
+ * Resolves an operationId to the URL/method advertised by the OpenAPI document.
+ * No endpoint-path fallback is attempted here: after the document is found, a missing operation
+ * means this FDP does not offer it.
+ */
+export async function bindOperation(
+  rootUri: string,
+  operationId: string,
+  pathParams?: Record<string, string>,
+): Promise<OperationBinding> {
+  const doc = await getCachedApiDocs(rootUri)
+  const operation = resolveOperation(doc, operationId)
+  if (!operation) {
+    throw new Error(`Operation '${operationId}' is not offered by this FDP's OpenAPI doc`)
+  }
+  const path = pathParams ? substitutePathParams(operation.path, pathParams) : operation.path
+  return { url: new URL(path, rootUri).toString(), method: operation.method }
+}
diff --git a/src/composables/fdpApi.ts b/src/composables/fdpApi.ts
index 397faf9..c6eb324 100644
--- a/src/composables/fdpApi.ts
+++ b/src/composables/fdpApi.ts
@@ -1,5 +1,3 @@
-import { getBaseUrl } from './urlUtils'
-
 let authToken: string | null = null
 
 /** Stores the JWT token to be included in subsequent requests as a Bearer header. */
@@ -21,17 +19,32 @@ export async function fetchRdfTurtle(uri: string): Promise<string> {
   return fetchRdf(uri, 'text/turtle')
 }
 
+/** Fetches an OpenAPI document as JSON from the given URL. */
+export async function fetchApiDocs(uri: string): Promise<unknown> {
+  const headers: Record<string, string> = { Accept: 'application/json' }
+  if (authToken) headers['Authorization'] = `Bearer ${authToken}`
+  const response = await fetch(uri, { headers })
+  if (!response.ok) throw new Error(`HTTP ${response.status}`)
+  return response.json()
+}
+
 /** Searches resources via the FDP full-text search endpoint. */
 // TODO: currently limited to the first 20 results; consider pagination or a larger page size.
-export async function searchResources(query: string): Promise<unknown[]> {
-  const base = getBaseUrl()
+export async function searchResources(
+  query: string,
+  url: string,
+  method: string,
+): Promise<unknown[]> {
   const headers: Record<string, string> = {
     'Content-Type': 'application/json',
     Accept: 'application/json',
   }
   if (authToken) headers['Authorization'] = `Bearer ${authToken}`
-  const response = await fetch(`${base}/search?page=0&size=20`, {
-    method: 'POST',
+  const searchUrl = new URL(url)
+  searchUrl.searchParams.set('page', '0')
+  searchUrl.searchParams.set('size', '20')
+  const response = await fetch(searchUrl.toString(), {
+    method,
     headers,
     body: JSON.stringify({ query }),
   })
@@ -40,30 +53,27 @@ export async function searchResources(query: string): Promise<unknown[]> {
 }
 
 /** Lists all users registered on the FDP. */
-export async function fetchUsers(): Promise<unknown[]> {
-  const base = getBaseUrl()
+export async function fetchUsers(url: string): Promise<unknown[]> {
   const headers: Record<string, string> = { Accept: 'application/json' }
   if (authToken) headers['Authorization'] = `Bearer ${authToken}`
-  const response = await fetch(`${base}/users`, { headers })
+  const response = await fetch(url, { headers })
   if (!response.ok) throw new Error(`HTTP ${response.status}`)
   return response.json() as Promise<unknown[]>
 }
 
-/** Deletes a user by UUID. */
-export async function deleteUser(uuid: string): Promise<void> {
-  const base = getBaseUrl()
+/** Deletes a user. */
+export async function deleteUser(url: string, method: string): Promise<void> {
   const headers: Record<string, string> = {}
   if (authToken) headers['Authorization'] = `Bearer ${authToken}`
-  const response = await fetch(`${base}/users/${uuid}`, { method: 'DELETE', headers })
+  const response = await fetch(url, { method, headers })
   if (!response.ok) throw new Error(`HTTP ${response.status}`)
 }
 
-/** Fetches a single user's profile by UUID. */
-export async function fetchUser(uuid: string): Promise<unknown> {
-  const base = getBaseUrl()
+/** Fetches a single user's profile. */
+export async function fetchUser(url: string): Promise<unknown> {
   const headers: Record<string, string> = { Accept: 'application/json' }
   if (authToken) headers['Authorization'] = `Bearer ${authToken}`
-  const response = await fetch(`${base}/users/${uuid}`, { headers })
+  const response = await fetch(url, { headers })
   if (!response.ok) throw new Error(`HTTP ${response.status}`)
   return response.json()
 }
@@ -72,24 +82,23 @@ export async function fetchUser(uuid: string): Promise<unknown> {
  * Creates a new user; body mirrors the backend's UserCreateDTO.
  * Error responses are assumed to carry { message: string } (e.g. "Email '...' is already taken").
  */
-export async function createUser(data: {
-  firstName: string
-  lastName: string
-  email: string
-  role: string
-  password: string
-}): Promise<unknown> {
-  const base = getBaseUrl()
+export async function createUser(
+  data: {
+    firstName: string
+    lastName: string
+    email: string
+    role: string
+    password: string
+  },
+  url: string,
+  method: string,
+): Promise<unknown> {
   const headers: Record<string, string> = {
     'Content-Type': 'application/json',
     Accept: 'application/json',
   }
   if (authToken) headers['Authorization'] = `Bearer ${authToken}`
-  const response = await fetch(`${base}/users`, {
-    method: 'POST',
-    headers,
-    body: JSON.stringify(data),
-  })
+  const response = await fetch(url, { method, headers, body: JSON.stringify(data) })
   if (!response.ok) {
     const body = await response.json().catch(() => null)
     throw new Error((body as { message?: string })?.message ?? `HTTP ${response.status}`)
@@ -99,20 +108,16 @@ export async function createUser(data: {
 
 /** Updates a user's profile fields; body mirrors the backend's UserChangeDTO. */
 export async function updateUser(
-  uuid: string,
   data: { firstName: string; lastName: string; email: string; role: string },
+  url: string,
+  method: string,
 ): Promise<unknown> {
-  const base = getBaseUrl()
   const headers: Record<string, string> = {
     'Content-Type': 'application/json',
     Accept: 'application/json',
   }
   if (authToken) headers['Authorization'] = `Bearer ${authToken}`
-  const response = await fetch(`${base}/users/${uuid}`, {
-    method: 'PUT',
-    headers,
-    body: JSON.stringify(data),
-  })
+  const response = await fetch(url, { method, headers, body: JSON.stringify(data) })
   if (!response.ok) {
     const body = await response.json().catch(() => null)
     throw new Error((body as { message?: string })?.message ?? `HTTP ${response.status}`)
@@ -121,15 +126,14 @@ export async function updateUser(
 }
 
 /** Updates a user's password. */
-export async function updateUserPassword(uuid: string, password: string): Promise<void> {
-  const base = getBaseUrl()
+export async function updateUserPassword(
+  password: string,
+  url: string,
+  method: string,
+): Promise<void> {
   const headers: Record<string, string> = { 'Content-Type': 'application/json' }
   if (authToken) headers['Authorization'] = `Bearer ${authToken}`
-  const response = await fetch(`${base}/users/${uuid}/password`, {
-    method: 'PUT',
-    headers,
-    body: JSON.stringify({ password }),
-  })
+  const response = await fetch(url, { method, headers, body: JSON.stringify({ password }) })
   if (!response.ok) {
     const body = await response.json().catch(() => null)
     throw new Error((body as { message?: string })?.message ?? `HTTP ${response.status}`)
@@ -137,20 +141,23 @@ export async function updateUserPassword(uuid: string, password: string): Promis
 }
 
 /** Fetches the currently authenticated user's profile. */
-export async function fetchCurrentUser(): Promise<unknown> {
-  const base = getBaseUrl()
+export async function fetchCurrentUser(url: string): Promise<unknown> {
   const headers: Record<string, string> = { Accept: 'application/json' }
   if (authToken) headers['Authorization'] = `Bearer ${authToken}`
-  const response = await fetch(`${base}/users/current`, { headers })
+  const response = await fetch(url, { headers })
   if (!response.ok) throw new Error(`HTTP ${response.status}`)
   return response.json()
 }
 
 /** Authenticates with the FDP and returns a JWT token. */
-export async function fetchToken(email: string, password: string): Promise<string> {
-  const base = getBaseUrl()
-  const response = await fetch(`${base}/tokens`, {
-    method: 'POST',
+export async function fetchToken(
+  email: string,
+  password: string,
+  url: string,
+  method: string,
+): Promise<string> {
+  const response = await fetch(url, {
+    method,
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ email, password }),
   })
diff --git a/src/composables/operationBinding.ts b/src/composables/operationBinding.ts
new file mode 100644
index 0000000..d908c26
--- /dev/null
+++ b/src/composables/operationBinding.ts
@@ -0,0 +1,41 @@
+import { ref, type Ref } from 'vue'
+import { bindOperation, type OperationBinding } from './apiDocs'
+import { getRootUri } from './urlUtils'
+import { configReady } from '@/config'
+
+/**
+ * Like bindOperation, but safe for module-level callers that evaluate before main.ts has awaited
+ * loadClientConfig(). Waiting for configReady avoids calling getRootUri() before runtime config
+ * exists.
+ */
+export function readyBinding(
+  operationId: string,
+  pathParams?: Record<string, string>,
+): Promise<OperationBinding> {
+  return (async () => {
+    await configReady
+    return bindOperation(getRootUri(), operationId, pathParams)
+  })()
+}
+
+/**
+ * Turns a binding into both a reactive UI flag and an awaitable router-guard check.
+ * Rejections mean "not available" here; consumers that need the underlying error should await the
+ * original binding instead.
+ */
+export function deriveAvailability(binding: Promise<OperationBinding>): {
+  available: Ref<boolean>
+  checked: Promise<boolean>
+} {
+  const available = ref(false)
+  const checked = binding
+    .then(() => {
+      available.value = true
+      return true
+    })
+    .catch(() => {
+      available.value = false
+      return false
+    })
+  return { available, checked }
+}
diff --git a/src/composables/urlUtils.ts b/src/composables/urlUtils.ts
index cb6e43f..8c86251 100644
--- a/src/composables/urlUtils.ts
+++ b/src/composables/urlUtils.ts
@@ -5,6 +5,11 @@ export function getBaseUrl(): string {
   return getClientConfig().apiEndpointUrl.replace(/\/$/, '')
 }
 
+/** @example getRootUri() // -> 'http://localhost/'  (when apiEndpointUrl = 'http://localhost') */
+export function getRootUri(): string {
+  return `${getBaseUrl()}/`
+}
+
 /**
  * RDF metadata can contain links to other resources on this FDP instance.
  * Internal links are handled by the Vue router; external links open in a new tab.
diff --git a/src/composables/useAuth.ts b/src/composables/useAuth.ts
index 7ae7f61..0b68f2b 100644
--- a/src/composables/useAuth.ts
+++ b/src/composables/useAuth.ts
@@ -1,5 +1,6 @@
 import { ref, computed } from 'vue'
 import { fetchToken, fetchCurrentUser, setAuthToken } from './fdpApi'
+import { readyBinding, deriveAvailability } from './operationBinding'
 
 // Mirrors UserDTO from the backend; role values come from the UserRole enum: ADMIN, USER.
 export type User = {
@@ -22,6 +23,26 @@ const isAdmin = computed(() => user.value?.role === 'ADMIN')
 
 setAuthToken(token.value)
 
+/** Reused by both availability checks and the login request. */
+const generateTokenBinding = readyBinding('generateToken')
+
+/** Reused anywhere the current authenticated user endpoint is needed. */
+const getUserCurrentBinding = readyBinding('getUserCurrent')
+
+/**
+ * Drives the "Edit profile" affordance and the /users/current route guard from the same
+ * OpenAPI-backed check.
+ */
+export const { available: getUserCurrentAvailable, checked: getUserCurrentChecked } =
+  deriveAvailability(getUserCurrentBinding)
+
+/**
+ * Drives the login button and /login route guard from whether this FDP advertises token-based
+ * login in its OpenAPI document.
+ */
+export const { available: loginAvailable, checked: loginAvailabilityChecked } =
+  deriveAvailability(generateTokenBinding)
+
 function clearSession() {
   token.value = null
   userEmail.value = null
@@ -33,7 +54,8 @@ function clearSession() {
 
 /** Resolves once the current user is loaded for an existing session; app mounting waits on this. */
 export const authReady: Promise<void> = token.value
-  ? fetchCurrentUser()
+  ? getUserCurrentBinding
+      .then((binding) => fetchCurrentUser(binding.url))
       .then((u) => {
         user.value = u as User
       })
@@ -67,10 +89,12 @@ export function userInitials(email: string | null): string {
 
 export function useAuth() {
   async function login(email: string, password: string): Promise<void> {
-    const newToken = await fetchToken(email, password)
+    const { url, method } = await generateTokenBinding
+    const newToken = await fetchToken(email, password, url, method)
     setAuthToken(newToken)
     try {
-      const currentUser = (await fetchCurrentUser()) as User
+      const currentUserUrl = (await getUserCurrentBinding).url
+      const currentUser = (await fetchCurrentUser(currentUserUrl)) as User
       token.value = newToken
       userEmail.value = email
       user.value = currentUser
diff --git a/src/composables/useSearch.ts b/src/composables/useSearch.ts
new file mode 100644
index 0000000..2729a3c
--- /dev/null
+++ b/src/composables/useSearch.ts
@@ -0,0 +1,12 @@
+import { readyBinding, deriveAvailability } from './operationBinding'
+
+// The operationId is search_1, not search: the generated OpenAPI doc uses search for a different
+// saved-query endpoint because both backend Java methods are named search().
+export const searchBinding = readyBinding('search_1')
+
+/**
+ * Drives both the header search box and /search route guard from whether this FDP advertises
+ * full-text search in its OpenAPI document.
+ */
+export const { available: searchAvailable, checked: searchChecked } =
+  deriveAvailability(searchBinding)
diff --git a/src/composables/useUsers.ts b/src/composables/useUsers.ts
new file mode 100644
index 0000000..f37651b
--- /dev/null
+++ b/src/composables/useUsers.ts
@@ -0,0 +1,46 @@
+import {
+  fetchUsers as apiFetchUsers,
+  createUser as apiCreateUser,
+  deleteUser as apiDeleteUser,
+} from './fdpApi'
+import { readyBinding, deriveAvailability } from './operationBinding'
+
+/** Drives the "Users" menu link and /users route guard. */
+export const { available: getUsersAvailable, checked: getUsersChecked } = deriveAvailability(
+  readyBinding('getUsers'),
+)
+
+/** Drives create-user UI and the /users/create route guard. */
+export const { available: createUserAvailable, checked: createUserChecked } = deriveAvailability(
+  readyBinding('createUser'),
+)
+
+/** Controls whether the per-user delete button is shown. */
+export const { available: deleteUserAvailable } = deriveAvailability(readyBinding('deleteUser'))
+
+/** Drives the /users/:id route guard. */
+export const { checked: getUserChecked } = deriveAvailability(readyBinding('getUser'))
+
+/** Lists all users through the OpenAPI-resolved getUsers operation. */
+export async function fetchUsers(): Promise<unknown[]> {
+  const { url } = await readyBinding('getUsers')
+  return apiFetchUsers(url)
+}
+
+/** Creates a user through the OpenAPI-resolved createUser operation. */
+export async function createUser(data: {
+  firstName: string
+  lastName: string
+  email: string
+  role: string
+  password: string
+}): Promise<unknown> {
+  const { url, method } = await readyBinding('createUser')
+  return apiCreateUser(data, url, method)
+}
+
+/** Deletes a user through the OpenAPI-resolved deleteUser operation. */
+export async function deleteUser(uuid: string): Promise<void> {
+  const { url, method } = await readyBinding('deleteUser', { uuid })
+  await apiDeleteUser(url, method)
+}
diff --git a/src/config.ts b/src/config.ts
index 6efdc36..894f2d6 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -21,6 +21,13 @@ const CONFIG_FILE_PATH = '/config.json'
 // and then use getClientConfig() whenever it is needed.
 let clientConfig: ClientConfig | undefined
 
+// Module-level bindings can evaluate before runtime config is loaded; configReady lets them wait
+// for loadClientConfig().
+let resolveConfigReady: () => void
+export const configReady: Promise<void> = new Promise((resolve) => {
+  resolveConfigReady = resolve
+})
+
 /**
  * Defines the runtime configuration for the application.
  */
@@ -40,7 +47,14 @@ export async function loadClientConfig(): Promise<void> {
     throw new Error(`Failed to load runtime configuration from file: ${CONFIG_FILE_PATH}`)
   }
   // Parse JSON and update the config object
-  clientConfig = (await response.json()) as ClientConfig
+  const parsed = (await response.json()) as ClientConfig
+  if (!parsed.apiEndpointUrl || typeof parsed.apiEndpointUrl !== 'string') {
+    throw new Error(
+      `Runtime configuration from ${CONFIG_FILE_PATH} is missing a valid "apiEndpointUrl"`,
+    )
+  }
+  clientConfig = parsed
+  resolveConfigReady()
 }
 
 /**
diff --git a/src/main.ts b/src/main.ts
index 8f510fd..8ad5783 100644
--- a/src/main.ts
+++ b/src/main.ts
@@ -8,9 +8,15 @@ import { loadClientConfig } from '@/config'
 
 const app = createApp(App)
 
-// Load runtime configuration from a JSON file.
-// Afterwards, we can use getClientConfig() to access the result at any time.
-await loadClientConfig()
+// Show a visible startup error when runtime config cannot be loaded; otherwise Vue never mounts
+// and the page is blank.
+try {
+  await loadClientConfig()
+} catch (err) {
+  document.getElementById('app')!.innerHTML =
+    '<p class="startup-error">Configuration error: this FDP client is not set up correctly.</p>'
+  throw err
+}
 
 authReady.then(() => {
   app.use(router)
diff --git a/src/router/index.ts b/src/router/index.ts
index 28a784c..33da491 100644
--- a/src/router/index.ts
+++ b/src/router/index.ts
@@ -5,7 +5,9 @@ import SearchView from '@/views/SearchView.vue'
 import NotAllowedView from '@/views/NotAllowedView.vue'
 import UsersView from '@/views/UsersView.vue'
 import UserFormView from '@/views/UserFormView.vue'
-import { useAuth } from '@/composables/useAuth'
+import { useAuth, loginAvailabilityChecked, getUserCurrentChecked } from '@/composables/useAuth'
+import { getUsersChecked, createUserChecked, getUserChecked } from '@/composables/useUsers'
+import { searchChecked } from '@/composables/useSearch'
 
 declare module 'vue-router' {
   interface RouteMeta {
@@ -69,10 +71,16 @@ const router = createRouter({
   ],
 })
 
-router.beforeEach((to) => {
+router.beforeEach(async (to) => {
   const { isLoggedIn, isAdmin } = useAuth()
   if (to.meta.requiresAuth && !isLoggedIn.value) return '/login'
   if (to.meta.requiresAdmin && !isAdmin.value) return '/not-allowed'
+  if (to.name === 'login' && !(await loginAvailabilityChecked)) return '/'
+  if (to.name === 'users' && !(await getUsersChecked)) return '/'
+  if (to.name === 'user-create' && !(await createUserChecked)) return '/'
+  if (to.name === 'user-detail' && !(await getUserChecked)) return '/'
+  if (to.name === 'user-profile' && !(await getUserCurrentChecked)) return '/'
+  if (to.name === 'search' && !(await searchChecked)) return '/'
 })
 
 export default router
diff --git a/src/views/SearchView.vue b/src/views/SearchView.vue
index 467976e..121a136 100644
--- a/src/views/SearchView.vue
+++ b/src/views/SearchView.vue
@@ -3,6 +3,7 @@ import { ref, watch, computed } from 'vue'
 import { useRoute } from 'vue-router'
 import { internalHref } from '../composables/urlUtils'
 import { searchResources } from '../composables/fdpApi'
+import { searchBinding } from '../composables/useSearch'
 
 type SearchResult = {
   uri: string
@@ -37,7 +38,8 @@ async function search(q: string) {
   loading.value = true
   error.value = null
   try {
-    results.value = (await searchResources(q)) as SearchResult[]
+    const { url, method } = await searchBinding
+    results.value = (await searchResources(q, url, method)) as SearchResult[]
   } catch (err) {
     error.value = err instanceof Error ? err.message : 'Search failed'
   } finally {
diff --git a/src/views/UserFormView.vue b/src/views/UserFormView.vue
index 768f89c..9fe9ff2 100644
--- a/src/views/UserFormView.vue
+++ b/src/views/UserFormView.vue
@@ -1,7 +1,10 @@
 <script setup lang="ts">
 import { ref, computed, onMounted } from 'vue'
 import { useRoute, useRouter, RouterLink } from 'vue-router'
-import { fetchUser, createUser, updateUser, updateUserPassword } from '../composables/fdpApi'
+import { fetchUser, updateUser, updateUserPassword } from '../composables/fdpApi'
+import { bindOperation, type OperationBinding } from '../composables/apiDocs'
+import { getRootUri } from '../composables/urlUtils'
+import { createUser, createUserAvailable } from '../composables/useUsers'
 import { useAuth, type User } from '../composables/useAuth'
 import UserProfileFields from '../components/UserProfileFields.vue'
 import { isValidEmail } from '../composables/formUtils'
@@ -17,6 +20,19 @@ const isCreate = computed(() => route.name === 'user-create')
 const isSelf = computed(() => route.name === 'user-profile')
 const userId = computed(() => (route.params.id as string | undefined) ?? 'current')
 
+/**
+ * Self-service profile routes use current-user operations. Admin routes use uuid-based user
+ * operations; /users/current is not the same endpoint with a path param.
+ */
+function selfOrUuidOperation(
+  selfOperationId: string,
+  uuidOperationId: string,
+): Promise<OperationBinding> {
+  return isSelf.value
+    ? bindOperation(getRootUri(), selfOperationId)
+    : bindOperation(getRootUri(), uuidOperationId, { uuid: userId.value })
+}
+
 const loading = ref(false)
 const loadError = ref<string | null>(null)
 
@@ -43,12 +59,17 @@ const savedName = ref('')
 const savedUuid = ref('')
 const pageTitle = computed(() => (isCreate.value ? 'Create user' : savedName.value || '…'))
 
+// Save buttons are shown only when the matching self/admin update operation is advertised.
+const profileEditAvailable = ref(false)
+const passwordEditAvailable = ref(false)
+
 /** Fetches the viewed/edited user's profile from the API and seeds the form fields. */
 async function loadUser() {
   loading.value = true
   loadError.value = null
   try {
-    const u = (await fetchUser(userId.value)) as User
+    const { url } = await selfOrUuidOperation('getUserCurrent', 'getUser')
+    const u = (await fetchUser(url)) as User
     firstName.value = u.firstName
     lastName.value = u.lastName
     email.value = u.email
@@ -110,12 +131,17 @@ async function submitProfile() {
   profileSuccess.value = null
   profileSaving.value = true
   try {
-    await updateUser(userId.value, {
-      firstName: firstName.value,
-      lastName: lastName.value,
-      email: email.value,
-      role: role.value,
-    })
+    const { url, method } = await selfOrUuidOperation('putUserCurrent', 'putUser')
+    await updateUser(
+      {
+        firstName: firstName.value,
+        lastName: lastName.value,
+        email: email.value,
+        role: role.value,
+      },
+      url,
+      method,
+    )
     savedName.value = `${firstName.value} ${lastName.value}`
     if (isSelf.value) {
       updateCurrentUser({
@@ -142,7 +168,8 @@ async function submitPassword() {
   passwordSuccess.value = null
   passwordSaving.value = true
   try {
-    await updateUserPassword(userId.value, newPassword.value)
+    const { url, method } = await selfOrUuidOperation('putUserCurrentPassword', 'putUserPassword')
+    await updateUserPassword(newPassword.value, url, method)
     newPassword.value = ''
     passwordConfirm.value = ''
     passwordSubmitted.value = false
@@ -155,7 +182,22 @@ async function submitPassword() {
 }
 
 onMounted(() => {
-  if (!isCreate.value) void loadUser()
+  if (isCreate.value) return
+  void loadUser()
+  selfOrUuidOperation('putUserCurrent', 'putUser')
+    .then(() => {
+      profileEditAvailable.value = true
+    })
+    .catch(() => {
+      profileEditAvailable.value = false
+    })
+  selfOrUuidOperation('putUserCurrentPassword', 'putUserPassword')
+    .then(() => {
+      passwordEditAvailable.value = true
+    })
+    .catch(() => {
+      passwordEditAvailable.value = false
+    })
 })
 </script>
 
@@ -203,7 +245,12 @@ onMounted(() => {
         </p>
       </div>
 
-      <button type="submit" class="user-form__btn" :disabled="profileSaving">
+      <button
+        v-if="createUserAvailable"
+        type="submit"
+        class="user-form__btn"
+        :disabled="profileSaving"
+      >
         {{ profileSaving ? 'Creating…' : 'Create user' }}
       </button>
     </form>
@@ -224,7 +271,12 @@ onMounted(() => {
             :hide-role="isSelf"
           />
 
-          <button type="submit" class="user-form__btn" :disabled="profileSaving">
+          <button
+            v-if="profileEditAvailable"
+            type="submit"
+            class="user-form__btn"
+            :disabled="profileSaving"
+          >
             {{ profileSaving ? 'Saving…' : 'Save profile' }}
           </button>
         </form>
@@ -262,7 +314,12 @@ onMounted(() => {
             </p>
           </div>
 
-          <button type="submit" class="user-form__btn" :disabled="passwordSaving">
+          <button
+            v-if="passwordEditAvailable"
+            type="submit"
+            class="user-form__btn"
+            :disabled="passwordSaving"
+          >
             {{ passwordSaving ? 'Updating…' : 'Update password' }}
           </button>
         </form>
diff --git a/src/views/UsersView.vue b/src/views/UsersView.vue
index bc9a835..adf43a1 100644
--- a/src/views/UsersView.vue
+++ b/src/views/UsersView.vue
@@ -1,7 +1,12 @@
 <script setup lang="ts">
 import { ref, onMounted } from 'vue'
 import { RouterLink } from 'vue-router'
-import { fetchUsers, deleteUser as apiDeleteUser } from '../composables/fdpApi'
+import {
+  fetchUsers,
+  deleteUser,
+  createUserAvailable,
+  deleteUserAvailable,
+} from '../composables/useUsers'
 import { avatarColor } from '../composables/useAuth'
 import type { User } from '../composables/useAuth'
 import IconTrash from '../assets/icons/trash.svg?component'
@@ -38,7 +43,7 @@ async function loadUsers() {
 async function handleDelete(user: User) {
   if (!window.confirm(`Are you sure you want to delete ${user.firstName} ${user.lastName}?`)) return
   try {
-    await apiDeleteUser(user.uuid)
+    await deleteUser(user.uuid)
     await loadUsers()
   } catch (err) {
     error.value = err instanceof Error ? err.message : 'Unable to delete user.'
@@ -52,7 +57,9 @@ onMounted(loadUsers)
   <main class="page-container">
     <div class="users-header">
       <h1 class="users-title">Users</h1>
-      <RouterLink to="/users/create" class="users-create-link">+ Create user</RouterLink>
+      <RouterLink v-if="createUserAvailable" to="/users/create" class="users-create-link"
+        >+ Create user</RouterLink
+      >
     </div>
 
     <p v-if="loading">Loading…</p>
@@ -73,7 +80,12 @@ onMounted(loadUsers)
           <div class="user-list__email">{{ user.email }}</div>
         </div>
         <div class="user-list__actions">
-          <button class="user-list__delete" data-tooltip="Remove" @click="handleDelete(user)">
+          <button
+            v-if="deleteUserAvailable"
+            class="user-list__delete"
+            data-tooltip="Remove"
+            @click="handleDelete(user)"
+          >
             <IconTrash />
           </button>
         </div>
diff --git a/tests/composables/apiDocs.test.ts b/tests/composables/apiDocs.test.ts
new file mode 100644
index 0000000..66ff49b
--- /dev/null
+++ b/tests/composables/apiDocs.test.ts
@@ -0,0 +1,220 @@
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { discoverApiDocsUrls, resolveOperation } from '../../src/composables/apiDocs'
+import { fetchRdfTurtle } from '../../src/composables/fdpApi'
+
+vi.mock('../../src/composables/fdpApi', () => ({ fetchRdfTurtle: vi.fn(), fetchApiDocs: vi.fn() }))
+
+const readFixture = (name: string) => readFileSync(resolve(__dirname, '../fixtures', name), 'utf-8')
+
+function setupFetchFixtures(fixtureMap: Record<string, string>) {
+  vi.mocked(fetchRdfTurtle).mockImplementation(async (uri: string) => {
+    const content = fixtureMap[uri]
+    if (!content) throw new Error(`No fixture for URI: ${uri}`)
+    return content
+  })
+}
+
+describe('discoverApiDocsUrls', () => {
+  afterEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('returns the declared dcat:endpointDescription when already at the root', async () => {
+    setupFetchFixtures({
+      'http://localhost': `
+        @prefix dcat: <http://www.w3.org/ns/dcat#> .
+        <http://localhost> dcat:endpointDescription <http://localhost/v3/api-docs> .
+      `,
+    })
+
+    expect(await discoverApiDocsUrls('http://localhost')).toEqual(['http://localhost/v3/api-docs'])
+    expect(fetchRdfTurtle).toHaveBeenCalledTimes(1)
+  })
+
+  it('returns just the /v3/api-docs fallback when the root has no dcat:endpointDescription', async () => {
+    setupFetchFixtures({
+      'http://localhost': `
+        @prefix dct: <http://purl.org/dc/terms/> .
+        <http://localhost> dct:title "My FAIR Data Point" .
+      `,
+    })
+
+    expect(await discoverApiDocsUrls('http://localhost')).toEqual(['http://localhost/v3/api-docs'])
+  })
+
+  it('returns multiple declared values in order, matching FDP 1.22+ which advertises both its OpenAPI doc and Swagger UI page', async () => {
+    setupFetchFixtures({
+      'http://localhost': `
+        @prefix dcat: <http://www.w3.org/ns/dcat#> .
+        <http://localhost> dcat:endpointDescription <http://localhost/v3/api-docs> .
+        <http://localhost> dcat:endpointDescription <http://localhost/swagger-ui.html> .
+      `,
+    })
+
+    expect(await discoverApiDocsUrls('http://localhost')).toEqual([
+      'http://localhost/v3/api-docs',
+      'http://localhost/swagger-ui.html',
+    ])
+  })
+})
+
+describe('bindOperation', () => {
+  beforeEach(() => {
+    vi.resetModules()
+  })
+  afterEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('skips a declared candidate that is not a usable OpenAPI document and uses the next one', async () => {
+    const { fetchRdfTurtle, fetchApiDocs } = await import('../../src/composables/fdpApi')
+    const { bindOperation } = await import('../../src/composables/apiDocs')
+
+    vi.mocked(fetchRdfTurtle).mockResolvedValue(`
+      @prefix dcat: <http://www.w3.org/ns/dcat#> .
+      <http://localhost/> dcat:endpointDescription <http://localhost/swagger-ui.html> .
+      <http://localhost/> dcat:endpointDescription <http://localhost/v3/api-docs> .
+    `)
+    vi.mocked(fetchApiDocs).mockImplementation(async (url: string) => {
+      if (url === 'http://localhost/swagger-ui.html') return '<html>not an OpenAPI doc</html>'
+      if (url === 'http://localhost/v3/api-docs') return JSON.parse(readFixture('api-docs.json'))
+      throw new Error(`unexpected fetch: ${url}`)
+    })
+
+    expect(await bindOperation('http://localhost/', 'generateToken')).toEqual({
+      url: 'http://localhost/tokens',
+      method: 'POST',
+    })
+    expect(fetchApiDocs).toHaveBeenCalledWith('http://localhost/swagger-ui.html')
+    expect(fetchApiDocs).toHaveBeenCalledWith('http://localhost/v3/api-docs')
+  })
+
+  it('rejects when none of the candidates are usable', async () => {
+    const { fetchRdfTurtle, fetchApiDocs } = await import('../../src/composables/fdpApi')
+    const { bindOperation } = await import('../../src/composables/apiDocs')
+
+    vi.mocked(fetchRdfTurtle).mockResolvedValue(`
+      @prefix dcat: <http://www.w3.org/ns/dcat#> .
+      <http://localhost/> dcat:endpointDescription <http://localhost/swagger-ui.html> .
+    `)
+    vi.mocked(fetchApiDocs).mockResolvedValue('<html>not an OpenAPI doc</html>')
+
+    await expect(bindOperation('http://localhost/', 'generateToken')).rejects.toThrow(
+      'No usable OpenAPI document found',
+    )
+  })
+
+  it('resolves with the url/method when the operation is found', async () => {
+    const { fetchRdfTurtle, fetchApiDocs } = await import('../../src/composables/fdpApi')
+    const { bindOperation } = await import('../../src/composables/apiDocs')
+
+    vi.mocked(fetchRdfTurtle).mockResolvedValue(`
+      @prefix dcat: <http://www.w3.org/ns/dcat#> .
+      <http://localhost/> dcat:endpointDescription <http://localhost/v3/api-docs> .
+    `)
+    vi.mocked(fetchApiDocs).mockResolvedValue(JSON.parse(readFixture('api-docs.json')))
+
+    expect(await bindOperation('http://localhost/', 'generateToken')).toEqual({
+      url: 'http://localhost/tokens',
+      method: 'POST',
+    })
+  })
+
+  it('rejects (no fallback) when the doc is fetched successfully but lacks the operationId', async () => {
+    const { fetchRdfTurtle, fetchApiDocs } = await import('../../src/composables/fdpApi')
+    const { bindOperation } = await import('../../src/composables/apiDocs')
+
+    vi.mocked(fetchRdfTurtle).mockResolvedValue(`
+      @prefix dcat: <http://www.w3.org/ns/dcat#> .
+      <http://localhost/> dcat:endpointDescription <http://localhost/v3/api-docs> .
+    `)
+    vi.mocked(fetchApiDocs).mockResolvedValue(JSON.parse(readFixture('api-docs.json')))
+
+    await expect(bindOperation('http://localhost/', 'deleteEverything')).rejects.toThrow(
+      "Operation 'deleteEverything' is not offered",
+    )
+  })
+
+  it('rejects when the api docs cannot be discovered at all', async () => {
+    const { fetchRdfTurtle } = await import('../../src/composables/fdpApi')
+    const { bindOperation } = await import('../../src/composables/apiDocs')
+
+    vi.mocked(fetchRdfTurtle).mockRejectedValue(new Error('network error'))
+
+    await expect(bindOperation('http://localhost/', 'generateToken')).rejects.toThrow(
+      'network error',
+    )
+  })
+
+  it('substitutes pathParams into the resolved path template', async () => {
+    const { fetchRdfTurtle, fetchApiDocs } = await import('../../src/composables/fdpApi')
+    const { bindOperation } = await import('../../src/composables/apiDocs')
+
+    vi.mocked(fetchRdfTurtle).mockResolvedValue(`
+      @prefix dcat: <http://www.w3.org/ns/dcat#> .
+      <http://localhost/> dcat:endpointDescription <http://localhost/v3/api-docs> .
+    `)
+    vi.mocked(fetchApiDocs).mockResolvedValue(JSON.parse(readFixture('api-docs.json')))
+
+    expect(await bindOperation('http://localhost/', 'deleteUser', { uuid: 'abc-123' })).toEqual({
+      url: 'http://localhost/users/abc-123',
+      method: 'DELETE',
+    })
+  })
+
+  it('URL-encodes path param values, not just substitutes them verbatim', async () => {
+    const { fetchRdfTurtle, fetchApiDocs } = await import('../../src/composables/fdpApi')
+    const { bindOperation } = await import('../../src/composables/apiDocs')
+
+    vi.mocked(fetchRdfTurtle).mockResolvedValue(`
+      @prefix dcat: <http://www.w3.org/ns/dcat#> .
+      <http://localhost/> dcat:endpointDescription <http://localhost/v3/api-docs> .
+    `)
+    vi.mocked(fetchApiDocs).mockResolvedValue(JSON.parse(readFixture('api-docs.json')))
+
+    expect(await bindOperation('http://localhost/', 'deleteUser', { uuid: 'a/b c' })).toEqual({
+      url: 'http://localhost/users/a%2Fb%20c',
+      method: 'DELETE',
+    })
+  })
+
+  it('rejects when a required path param is missing', async () => {
+    const { fetchRdfTurtle, fetchApiDocs } = await import('../../src/composables/fdpApi')
+    const { bindOperation } = await import('../../src/composables/apiDocs')
+
+    vi.mocked(fetchRdfTurtle).mockResolvedValue(`
+      @prefix dcat: <http://www.w3.org/ns/dcat#> .
+      <http://localhost/> dcat:endpointDescription <http://localhost/v3/api-docs> .
+    `)
+    vi.mocked(fetchApiDocs).mockResolvedValue(JSON.parse(readFixture('api-docs.json')))
+
+    await expect(bindOperation('http://localhost/', 'deleteUser', {})).rejects.toThrow(
+      "Missing path parameter 'uuid'",
+    )
+  })
+})
+
+describe('resolveOperation', () => {
+  const doc: unknown = JSON.parse(readFixture('api-docs.json'))
+
+  it('finds the path and uppercased method for a matching operationId', () => {
+    expect(resolveOperation(doc, 'generateToken')).toEqual({ path: '/tokens', method: 'POST' })
+  })
+
+  it('finds an operationId among multiple methods on the same path', () => {
+    expect(resolveOperation(doc, 'getUser')).toEqual({ path: '/users/{uuid}', method: 'GET' })
+    expect(resolveOperation(doc, 'putUser')).toEqual({ path: '/users/{uuid}', method: 'PUT' })
+    expect(resolveOperation(doc, 'deleteUser')).toEqual({ path: '/users/{uuid}', method: 'DELETE' })
+  })
+
+  it('returns null for an unknown operationId', () => {
+    expect(resolveOperation(doc, 'deleteEverything')).toBeNull()
+  })
+
+  it('returns null when the document has no paths', () => {
+    expect(resolveOperation({}, 'generateToken')).toBeNull()
+    expect(resolveOperation(null, 'generateToken')).toBeNull()
+  })
+})
diff --git a/tests/composables/useAuth.test.ts b/tests/composables/useAuth.test.ts
index 9cfb88e..ac65e6e 100644
--- a/tests/composables/useAuth.test.ts
+++ b/tests/composables/useAuth.test.ts
@@ -1,5 +1,10 @@
-import { describe, it, expect, vi, afterEach } from 'vitest'
-import { useAuth, userInitials } from '../../src/composables/useAuth'
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import type {
+  useAuth as UseAuth,
+  userInitials as UserInitials,
+} from '../../src/composables/useAuth'
 
 vi.hoisted(() => {
   const store: Record<string, string> = {}
@@ -11,31 +16,68 @@ vi.hoisted(() => {
     removeItem: (key: string) => {
       delete store[key]
     },
+    clear: () => {
+      for (const key of Object.keys(store)) delete store[key]
+    },
   } as Storage
 })
 
-// login
+const apiDocsFixture: unknown = JSON.parse(
+  readFileSync(resolve(__dirname, '../fixtures/api-docs.json'), 'utf-8'),
+)
+
+/**
+ * login()/authReady resolve generateToken and getUserCurrent via bindOperation before making the
+ * real request, so tests need to mock that resolution too (root Turtle fetch + /v3/api-docs
+ * fetch), not just the /tokens and /users/current calls themselves. handleAction covers only the
+ * latter; discovery is mocked identically for every test here, so it's factored out.
+ */
+function mockLoginFetch(
+  handleAction: (url: string, init?: RequestInit) => Promise<unknown> | unknown,
+) {
+  return vi.fn(async (url: string, init?: RequestInit) => {
+    const accept = (init?.headers as Record<string, string> | undefined)?.Accept
+    if (accept === 'text/turtle') return { ok: true, text: async () => '' }
+    if (url === 'http://localhost/v3/api-docs')
+      return { ok: true, json: async () => apiDocsFixture }
+    return handleAction(url, init)
+  })
+}
+
+// generateTokenBinding/getUserCurrentBinding are singletons resolved once, when useAuth.ts is
+// first imported, so a fetch mock must be active *before* that import, not just before login()
+// is called, or the first resolution attempt hits a real, unmocked fetch and caches a rejected
+// binding for that module instance. vi.resetModules() + a dynamic import per test (see
+// apiDocs.test.ts for the same pattern) ensures this. The default stub below covers describe
+// blocks that don't care about resolution at all (updateCurrentUser, userInitials).
+beforeEach(() => {
+  vi.resetModules()
+  vi.stubGlobal('fetch', vi.fn().mockResolvedValue({ ok: false, status: 0 }))
+})
+afterEach(() => {
+  vi.unstubAllGlobals()
+  sessionStorage.clear()
+})
 
 describe('login', () => {
-  afterEach(() => {
-    useAuth().logout()
-    vi.unstubAllGlobals()
-  })
-
   it('sets token, email, and isLoggedIn on success', async () => {
-    vi.stubGlobal('fetch', async (url: string) => ({
-      ok: true,
-      json: async () =>
-        String(url).endsWith('/tokens')
-          ? { token: 'efIobn394nvJJFJ30...' }
-          : {
-              uuid: '1',
-              firstName: 'Albert',
-              lastName: 'Einstein',
-              email: 'user@example.com',
-              role: 'USER',
-            },
-    }))
+    vi.stubGlobal(
+      'fetch',
+      mockLoginFetch(async (url) => ({
+        ok: true,
+        json: async () =>
+          String(url).endsWith('/tokens')
+            ? { token: 'efIobn394nvJJFJ30...' }
+            : {
+                uuid: '1',
+                firstName: 'Albert',
+                lastName: 'Einstein',
+                email: 'user@example.com',
+                role: 'USER',
+              },
+      })),
+    )
+    const { useAuth } = await import('../../src/composables/useAuth')
     const { login, token, userEmail, isLoggedIn } = useAuth()
     await login('user@example.com', 'secret')
     expect(token.value).toBe('efIobn394nvJJFJ30...')
@@ -44,19 +86,23 @@ describe('login', () => {
   })
 
   it('sets user and isAdmin after successful login', async () => {
-    vi.stubGlobal('fetch', async (url: string) => ({
-      ok: true,
-      json: async () =>
-        String(url).endsWith('/tokens')
-          ? { token: 'tok123' }
-          : {
-              uuid: 'u1',
-              firstName: 'Albert',
-              lastName: 'Einstein',
-              email: 'a@example.com',
-              role: 'ADMIN',
-            },
-    }))
+    vi.stubGlobal(
+      'fetch',
+      mockLoginFetch(async (url) => ({
+        ok: true,
+        json: async () =>
+          String(url).endsWith('/tokens')
+            ? { token: 'tok123' }
+            : {
+                uuid: 'u1',
+                firstName: 'Albert',
+                lastName: 'Einstein',
+                email: 'a@example.com',
+                role: 'ADMIN',
+              },
+      })),
+    )
+    const { useAuth } = await import('../../src/composables/useAuth')
     const { login, user, isAdmin } = useAuth()
     await login('a@example.com', 'secret')
     expect(user.value).toMatchObject({ firstName: 'Albert', lastName: 'Einstein', role: 'ADMIN' })
@@ -64,11 +110,15 @@ describe('login', () => {
   })
 
   it('clears session and rejects when /users/current fails', async () => {
-    vi.stubGlobal('fetch', async (url: string) => {
-      if (String(url).endsWith('/tokens'))
-        return { ok: true, json: async () => ({ token: 'tok123' }) }
-      return { ok: false, status: 500 }
-    })
+    vi.stubGlobal(
+      'fetch',
+      mockLoginFetch(async (url) => {
+        if (String(url).endsWith('/tokens'))
+          return { ok: true, json: async () => ({ token: 'tok123' }) }
+        return { ok: false, status: 500 }
+      }),
+    )
+    const { useAuth } = await import('../../src/composables/useAuth')
     const { login, token, user, isLoggedIn } = useAuth()
     await expect(login('a@example.com', 'secret')).rejects.toThrow()
     expect(token.value).toBeNull()
@@ -77,19 +127,27 @@ describe('login', () => {
   })
 
   it('throws "Invalid email or password" on 401', async () => {
-    vi.stubGlobal('fetch', async () => ({ ok: false, status: 401 }))
+    vi.stubGlobal(
+      'fetch',
+      mockLoginFetch(async () => ({ ok: false, status: 401 })),
+    )
+    const { useAuth } = await import('../../src/composables/useAuth')
     const { login } = useAuth()
     await expect(login('user@example.com', 'wrong')).rejects.toThrow('Invalid email or password')
   })
 
   it('throws "Login failed" on other HTTP errors', async () => {
-    vi.stubGlobal('fetch', async () => ({ ok: false, status: 500 }))
+    vi.stubGlobal(
+      'fetch',
+      mockLoginFetch(async () => ({ ok: false, status: 500 })),
+    )
+    const { useAuth } = await import('../../src/composables/useAuth')
     const { login } = useAuth()
     await expect(login('user@example.com', 'secret')).rejects.toThrow('Login failed (HTTP 500)')
   })
 
   it('posts credentials to the tokens endpoint', async () => {
-    const mockFetch = vi.fn(async (url: string) => ({
+    const mockFetch = mockLoginFetch(async (url) => ({
       ok: true,
       json: async () =>
         String(url).endsWith('/tokens')
@@ -97,35 +155,33 @@ describe('login', () => {
           : { uuid: '1', firstName: 'A', lastName: 'B', email: 'user@example.com', role: 'USER' },
     }))
     vi.stubGlobal('fetch', mockFetch)
+    const { useAuth } = await import('../../src/composables/useAuth')
     const { login } = useAuth()
     await login('user@example.com', 'secret')
-    expect(mockFetch).toHaveBeenNthCalledWith(1, 'http://localhost/tokens', {
+    expect(mockFetch).toHaveBeenCalledWith('http://localhost/tokens', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ email: 'user@example.com', password: 'secret' }),
     })
-    expect(mockFetch).toHaveBeenNthCalledWith(2, 'http://localhost/users/current', {
+    expect(mockFetch).toHaveBeenCalledWith('http://localhost/users/current', {
       headers: { Accept: 'application/json', Authorization: 'Bearer efIobn394nvJJFJ30...' },
     })
   })
 })
 
-// logout
-
 describe('logout', () => {
-  afterEach(() => {
-    useAuth().logout()
-    vi.unstubAllGlobals()
-  })
-
   it('clears token, email, and isLoggedIn', async () => {
-    vi.stubGlobal('fetch', async (url: string) => ({
-      ok: true,
-      json: async () =>
-        String(url).endsWith('/tokens')
-          ? { token: 'efIobn394nvJJFJ30...' }
-          : { uuid: '1', firstName: 'A', lastName: 'B', email: 'user@example.com', role: 'USER' },
-    }))
+    vi.stubGlobal(
+      'fetch',
+      mockLoginFetch(async (url) => ({
+        ok: true,
+        json: async () =>
+          String(url).endsWith('/tokens')
+            ? { token: 'efIobn394nvJJFJ30...' }
+            : { uuid: '1', firstName: 'A', lastName: 'B', email: 'user@example.com', role: 'USER' },
+      })),
+    )
+    const { useAuth } = await import('../../src/composables/useAuth')
     const { login, logout, token, userEmail, isLoggedIn } = useAuth()
     await login('user@example.com', 'secret')
     logout()
@@ -135,11 +191,11 @@ describe('logout', () => {
   })
 })
 
-// updateCurrentUser
-
 describe('updateCurrentUser', () => {
-  afterEach(() => {
-    useAuth().logout()
+  let useAuth: typeof UseAuth
+
+  beforeEach(async () => {
+    ;({ useAuth } = await import('../../src/composables/useAuth'))
   })
 
   it('updates user and userEmail', () => {
@@ -156,9 +212,13 @@ describe('updateCurrentUser', () => {
   })
 })
 
-// userInitials
-
 describe('userInitials', () => {
+  let userInitials: typeof UserInitials
+
+  beforeEach(async () => {
+    ;({ userInitials } = await import('../../src/composables/useAuth'))
+  })
+
   it('returns "?" for null', () => {
     expect(userInitials(null)).toBe('?')
   })
diff --git a/tests/config.test.ts b/tests/config.test.ts
new file mode 100644
index 0000000..6f84df3
--- /dev/null
+++ b/tests/config.test.ts
@@ -0,0 +1,91 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+// tests/vitest.setup.ts mocks '@/config' globally for every other test file; undo that here so
+// we can test the real implementation.
+vi.unmock('@/config')
+
+describe('loadClientConfig', () => {
+  beforeEach(() => {
+    vi.resetModules()
+    vi.unstubAllGlobals()
+  })
+
+  it('loads a valid apiEndpointUrl', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn().mockResolvedValue({
+        ok: true,
+        json: async () => ({ apiEndpointUrl: 'http://localhost' }),
+      }),
+    )
+    const { loadClientConfig, getClientConfig } = await import('../src/config')
+
+    await loadClientConfig()
+
+    expect(getClientConfig()).toEqual({ apiEndpointUrl: 'http://localhost' })
+  })
+
+  it('throws when the config file fetch fails', async () => {
+    vi.stubGlobal('fetch', vi.fn().mockResolvedValue({ ok: false }))
+    const { loadClientConfig } = await import('../src/config')
+
+    await expect(loadClientConfig()).rejects.toThrow('Failed to load runtime configuration')
+  })
+
+  it('throws when apiEndpointUrl is missing from the config file', async () => {
+    vi.stubGlobal('fetch', vi.fn().mockResolvedValue({ ok: true, json: async () => ({}) }))
+    const { loadClientConfig } = await import('../src/config')
+
+    await expect(loadClientConfig()).rejects.toThrow('missing a valid "apiEndpointUrl"')
+  })
+
+  it('throws when apiEndpointUrl is an empty string', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn().mockResolvedValue({ ok: true, json: async () => ({ apiEndpointUrl: '' }) }),
+    )
+    const { loadClientConfig } = await import('../src/config')
+
+    await expect(loadClientConfig()).rejects.toThrow('missing a valid "apiEndpointUrl"')
+  })
+
+  it('getClientConfig throws before loadClientConfig has been called', async () => {
+    const { getClientConfig } = await import('../src/config')
+
+    expect(() => getClientConfig()).toThrow('Runtime configuration not loaded')
+  })
+})
+
+describe('configReady', () => {
+  beforeEach(() => {
+    vi.resetModules()
+    vi.unstubAllGlobals()
+  })
+
+  it('resolves once loadClientConfig succeeds', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn().mockResolvedValue({
+        ok: true,
+        json: async () => ({ apiEndpointUrl: 'http://localhost' }),
+      }),
+    )
+    const { loadClientConfig, configReady } = await import('../src/config')
+
+    await loadClientConfig()
+
+    await expect(configReady).resolves.toBeUndefined()
+  })
+
+  it('stays pending until loadClientConfig has actually resolved', async () => {
+    const { configReady } = await import('../src/config')
+    const stillPending = Symbol('pending')
+
+    const result = await Promise.race([
+      configReady.then(() => 'resolved'),
+      new Promise((resolve) => setTimeout(() => resolve(stillPending), 10)),
+    ])
+
+    expect(result).toBe(stillPending)
+  })
+})
diff --git a/tests/fixtures/api-docs.json b/tests/fixtures/api-docs.json
new file mode 100644
index 0000000..47d39aa
--- /dev/null
+++ b/tests/fixtures/api-docs.json
@@ -0,0 +1,461 @@
+{
+  "openapi": "3.1.0",
+  "paths": {
+    "/tokens": {
+      "post": {
+        "operationId": "generateToken",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AuthDTO"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/TokenDTO"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Bad request"
+          },
+          "401": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Resource Not Found"
+          }
+        },
+        "tags": ["Authentication and Authorization"]
+      }
+    },
+    "/users": {
+      "get": {
+        "operationId": "getUsers",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/UserDTO"
+                  }
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Bad request"
+          },
+          "401": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Resource Not Found"
+          }
+        },
+        "tags": ["User Management"]
+      },
+      "post": {
+        "operationId": "createUser",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/UserCreateDTO"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/UserDTO"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Bad request"
+          },
+          "401": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Resource Not Found"
+          }
+        },
+        "tags": ["User Management"]
+      }
+    },
+    "/users/current": {
+      "get": {
+        "operationId": "getUserCurrent",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/UserDTO"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Bad request"
+          },
+          "401": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Resource Not Found"
+          }
+        },
+        "tags": ["Authentication and Authorization", "User Management"]
+      }
+    },
+    "/users/{uuid}": {
+      "delete": {
+        "operationId": "deleteUser",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "uuid",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No Content"
+          },
+          "400": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Bad request"
+          },
+          "401": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Resource Not Found"
+          }
+        },
+        "tags": ["User Management"]
+      },
+      "get": {
+        "operationId": "getUser",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "uuid",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/UserDTO"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Bad request"
+          },
+          "401": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Resource Not Found"
+          }
+        },
+        "tags": ["User Management"]
+      },
+      "put": {
+        "operationId": "putUser",
+        "parameters": [
+          {
+            "in": "path",
+            "name": "uuid",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/UserChangeDTO"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/UserDTO"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Bad request"
+          },
+          "401": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorDTO"
+                }
+              }
+            },
+            "description": "Resource Not Found"
+          }
+        },
+        "tags": ["User Management"]
+      }
+    }
+  }
+}
diff --git a/tests/vitest.setup.ts b/tests/vitest.setup.ts
index 27bd427..20e910e 100644
--- a/tests/vitest.setup.ts
+++ b/tests/vitest.setup.ts
@@ -14,5 +14,6 @@ vi.mock('@/config', () => {
   return {
     loadClientConfig: vi.fn().mockResolvedValue(undefined),
     getClientConfig: vi.fn().mockReturnValue(testClientConfig),
+    configReady: Promise.resolve(),
   }
 })