System

Streams an asset by id for the calling customer. Serves everything the public mount serves, plus the owner-only assets belonging to the caller's own organization (support attachments, service configs, server backups). Owner-only responses are marked privately cacheable and short-lived; publicly readable ones carry the same day-long public caching as the public mount.

Streams a publicly readable asset by id: catalog icons, reseller icons and OG images, and avatars. Requires no authentication, and reads no caller identity even if one is presented. An asset whose kind is owner-scoped (support attachments, service configs, server backups) is reported as forbidden here regardless of who asks -- fetch those from the console mount instead. Responses are cacheable for a day; the id is not a content hash, so replacing an icon reuses it.

Resolves a storefront's branding from the hostname it is served on: name, brand colour, logo, Discord invite and OpenGraph image. Unauthenticated, because a storefront has to paint itself before anybody has logged in, and therefore deliberately narrow. A hostname belonging to no live, enabled reseller answers 404.

Resolves the captcha configuration a browser must honour for the host it is on: provider, public site key, and which actions (login, register, password reset and so on) require a solved challenge. Unauthenticated, because it has to answer before anyone has signed in -- that is the whole point of a pre-login captcha. Never returns a secret key; there is no secret field on this response at all. A hostname matching a live, enabled reseller answers that reseller's own configuration; any other hostname, including one belonging to no reseller at all, answers the platform's. Never 404s: an unmatched or malformed hostname resolves to the platform default rather than an error.

Lists the platform incidents that are happening right now, for the customer-facing outage banner. Deliberately unauthenticated: the moment this read matters most is the one where the caller cannot sign in. Resolved incidents are never returned, and each entry carries only the headline, the optional detail text and when it began.

Lists the maintenance windows that have not been cancelled and are scheduled no earlier than 24 hours ago, soonest first, for the customer-facing maintenance banner. Deliberately unauthenticated. Each entry carries only the headline, the start and the expected duration.

Records one client-side crash from a browser, for the platform's own diagnostics. Deliberately unauthenticated: the crashes worth hearing about include the ones that happen before, or instead of, a caller being able to sign in. Answers 204 unconditionally -- a crash reporter that returns an error makes the crash worse -- so a success here means the report was accepted, never that it was stored. message is truncated to 2000 characters and stack to 8000; an over-long report is shortened, never rejected. Rate limited per source address.

Says which optional capabilities this deployment runs. A partner who hosts their own kernel may leave registry, payment providers, object storage pools, the unit log and metrics stores, Domain Connect, mail and similar unconfigured; a capability answering false is absent here. Its routes refuse with 501 capability-not-available, its products are not in the catalog, and clients must not render its UI. A pool or processor that cannot be read at this moment reports false.