接口详情
GET /v1/system-settings/csp-hosts
Read the global JavaScript report hosts for the web container CSP
- operationId
getGlobalJavaScriptCSPHosts- 认证
- 所需权限
契约没有单独标注权限码，权限要求见下方说明与 403 响应。
说明（契约原文）
Unauthenticated. The web container's nginx calls it (auth_request) before serving index.html and adds the returned https sources to the page CSP connect-src and img-src. The external path is not routed by the container; only its internal subrequest reaches it. When it fails the page keeps the strict default CSP.
响应
getGlobalJavaScriptCSPHosts 响应| 状态码 | 说明 |
|---|
204 | Space-separated CSP sources (https://host ...), possibly empty. |
|---|
404 | Query parameters are not accepted |
|---|
405 | Method not allowed |
|---|
503 | Settings storage is unavailable |
|---|
失败时怎么办
404 资源不存在或不属于当前租户。503 依赖暂不可用：稍后用原 Idempotency-Key 重试。
↑ 回到列表
Read the display subset of platform settings
- operationId
getPublicPlatformSystemSettings- 认证
- 登录会话：主控登录后的 Bearer 会话，由客户本人在自己的主控里使用；插件不能要求客户交出会话。
- 无需认证。
- 所需权限
契约没有单独标注权限码，权限要求见下方说明与 403 响应。
说明（契约原文）
Without an Authorization header (the sign-in page) it returns only the system name and the two console titles (PublicBranding). Any valid administrator or tenant session additionally gets the package purchase notice (HTML, sanitized by the client before rendering) and the global JavaScript loaded by the tenant user console. An Authorization header that is present but invalid is refused with 401.
响应
getPublicPlatformSystemSettings 响应| 状态码 | 说明 |
|---|
200 | Branding only when anonymous; the full public subset for a valid session. |
|---|
401 | Authorization header present but invalid |
|---|
405 | Method not allowed |
|---|
503 | Settings storage is unavailable |
|---|
失败时怎么办
401 检查凭据格式、是否过期或被轮换。503 依赖暂不可用：稍后用原 Idempotency-Key 重试。
↑ 回到列表