Skip to main content

​
HTTP API overview

Production base URL: https://superflag.sh. Management and delivery routes are under /api/v1. OFREP is under /api/ofrep/v1.

​
Discover the current contract

The contract endpoint exposes server capabilities. The OpenAPI 3.1 document covers advanced config, remote evaluation, telemetry ingestion, atomic bulk apply, and OFREP. Prefer these live versioned contracts over copied endpoint assumptions.

​
Authentication

Send Authorization: Bearer <credential> unless an endpoint says otherwise. OFREP also accepts X-API-Key. Token prefixes are an early type check. The server validates the complete credential, revocation state, tenant ownership, and route-specific scope.

​
Route families

​
Error and cache behavior

Modern management routes use a strict { apiVersion, error } envelope with a stable code, human-readable message, and optional safe metadata. HTTP status is the transport-level failure category. Retryability, remediation, and request metadata are CLI-envelope features and are not fields every HTTP route returns. The two frozen legacy config routes retain compatibility error shapes; do not parse them as the management envelope. Config responses use authorization-scoped opaque ETags with:
Never share config responses or ETags across credentials. Remote evaluation and telemetry responses are private and are not general cacheable API responses.

Configuration and evaluation

Frozen delivery, advanced schema, ETags, quotas, and remote evaluation.

Management API

Apps, flags, keys, atomic apply, journal, metrics, and experiments.