List Geographies

Areas StatsMapped knows about.

with_boundary=true returns GeoJSON geometry — off by default because the raw boundaries are heavy: Tailte's Generalised-20m layers still carry full coastline and island detail, so the 8 CSO regions alone are 3.2 MB unsimplified.

simplify is a Douglas-Peucker tolerance in degrees, applied server-side via ST_SimplifyPreserveTopology. The default 0.005 (~500 m) is far below what is visible on a map of Ireland a few hundred pixels wide, and cuts the payload by ~95%. Pass simplify=0 for the exact boundary.

Caveat worth knowing: simplification is per-geometry, so adjacent areas can develop hairline gaps at shared borders. Acceptable for a choropleth at this scale; use simplify=0 if the geometry is ever needed for real spatial analysis rather than display.

simplify and min_part_km2 are capped (0.1 degrees, 1000 km²) rather than left unbounded — the front end only ever requests the defaults, and an uncapped value on either param is a resource-cost knob a caller could otherwise turn arbitrarily far in either direction on a shared free-tier database (security-architecture-and-audit.md §4). 0 remains a valid floor for both so the documented "exact boundary" escape hatch for real spatial analysis still works; the caps only stop nonsensical/extreme inputs.

level is required when with_boundary=true (cycle 45, Option B of the security-privacy-auditor's 2026-08-27 open-routes finding: with_boundary=true with no level filter had no row cap against a 4-connection pool -- one request could ask for the full boundary set, every level at once, at full resolution). level stays optional without with_boundary -- app.js's own bare fetch('/api/geographies') (state.geoIndex at init()) needs the full unfiltered index and requests no geometry, so it carries none of the cost this guards against. Checked live: every existing with_boundary=true call site (map.js's two) already passes level, so this tightens the contract without breaking a real caller.