Every v4 request is signed client-side. The route list itself is loaded from a build artifact next to the bundle.
Goal: find the unused route in the map and forge a valid signature for it.
Watch the Network tab while the page loads. The bundle fetches a route map before it fetches anything else. Base64 decode the values.
The second route rejects you with 401 bad signature. In /JSRECON/js/l4.app.js, _sign(nonce) = djb2 hash of nonce + salt, hex encoded. The salt is stored as char codes XORed with a one-byte mask.
You do not have to rewrite the signer. In the console on this page run __signed(atob(__routes.export), "hunter2") and open the URL it returns.