Operation details
GET /v1/system-settings/csp-hosts
Read the global JavaScript report hosts for the web container CSP
- operationId
getGlobalJavaScriptCSPHosts- Auth
- Required permissions
The contract has no separate permission annotation; see the description below and the 403 response.
Description (from the contract)
Unauthenticated. The web container's nginx calls it (auth_request) before serving index.html and adds the returned https sources to the page CSP connect-src and img-src. The external path is not routed by the container; only its internal subrequest reaches it. When it fails the page keeps the strict default CSP.
Responses
getGlobalJavaScriptCSPHosts Responses| Status | Description |
|---|
204 | Space-separated CSP sources (https://host ...), possibly empty. |
|---|
404 | Query parameters are not accepted |
|---|
405 | Method not allowed |
|---|
503 | Settings storage is unavailable |
|---|
What to do on failure
404 The resource does not exist or belongs to another tenant.503 A dependency is unavailable: retry later with the original Idempotency-Key.
↑ Back to list
Read the display subset of platform settings
- operationId
getPublicPlatformSystemSettings- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- No authentication.
- Required permissions
The contract has no separate permission annotation; see the description below and the 403 response.
Description (from the contract)
Without an Authorization header (the sign-in page) it returns only the system name and the two console titles (PublicBranding). Any valid administrator or tenant session additionally gets the package purchase notice (HTML, sanitized by the client before rendering) and the global JavaScript loaded by the tenant user console. An Authorization header that is present but invalid is refused with 401.
Responses
getPublicPlatformSystemSettings Responses| Status | Description |
|---|
200 | Branding only when anonymous; the full public subset for a valid session. |
|---|
401 | Authorization header present but invalid |
|---|
405 | Method not allowed |
|---|
503 | Settings storage is unavailable |
|---|
What to do on failure
401 Check the credential format and whether it expired or was rotated.503 A dependency is unavailable: retry later with the original Idempotency-Key.
↑ Back to list