Feature 7
Public APIs & machine-readable state
Same truth for humans and integrations.
Live /.well-known/hc/v1/* + /v1/verification/vouches
About this feature
Why it matters
Alternate clients, CI, and reviewers can verify behavior without scraping HTML. Status JSON powers vouch eligibility checks and future storefront flows.
Design decisions
Open protocol version 1.0; reference operator on Cloudflare. Writes require signed bodies; reads return public card JSON, scan status, health. CORS enabled for create flow from Pages.
Safety · privacy · security
Public endpoints expose only public state. Error codes are typed (e.g. VOUCH_QUOTA_EXCEEDED, REPLAYED_NONCE) for safe client handling.
Limits
No bulk graph export. Rate limits and auth for operator tools still evolving.
Future directions
Webhooks for commerce, federated read replicas, signed activity stream ingestion APIs.