Browser control-plane contract v1

Support boundary

Contract version 1.0.0 describes selected reads used by the BlinkHost browser experience. It is repository-validated against server routing. It is not a GA programmatic automation API, does not grant permission to call other discovered routes, and does not make browser sessions exportable credentials.

Method	Path	Supported purpose
GET	/api/health/ready	Public readiness without customer data
GET	/api/auth/me/	Current authenticated browser identity
GET	/api/sites/	Tenant-scoped site metadata
GET	/api/deployments/	Tenant-scoped immutable deployment metadata
GET	/api/databases/	Tenant-scoped database metadata without provider credentials

Authentication and isolation

Authenticated reads use BlinkHost's secure HttpOnly browser session. Browser mutations additionally require the CSRF boundary. Never copy a session cookie into a script, attempt to read it from frontend code, or publish it as an API key. Resources outside the active tenant boundary may return 404 rather than reveal their existence.

Errors, pagination, and retries

Treat 400 as invalid input, 401 as absent or expired authentication, 403 as insufficient role or entitlement, 404 as absent or tenant-hidden, 409 as a state conflict, 429 as bounded capacity, and 503 as temporary unavailability. Collection response and pagination details remain endpoint-specific until a GA automation API is published. Retry safe reads with bounded backoff; do not turn an ambiguous mutation into a new operation identity.

Internal, operations, webhook, compiler-control, provider-token, and edge-control routes are excluded from this public contract. Request a supported automation capability rather than depending on an undocumented route.