Control-plane API status and boundaries

Authentication status

The documented control-plane routes currently support BlinkHost's authenticated browser experience. Mutations require the secure HttpOnly session and CSRF boundary. Programmatic customer API keys are not currently labeled GA. Never copy a browser cookie into a script.

Selected browser contracts

• GET /api/health/ready is public readiness and returns no customer data.
• GET /api/auth/me/ returns the current authenticated identity.
• GET /api/sites/ and related mutations are tenant-scoped.
• GET /api/deployments/ returns tenant-scoped immutable deployments.
• GET /api/databases/ returns database metadata and never plaintext provider credentials.

Error semantics

Treat 400 as invalid input, 401 as missing or expired authentication, 403 as insufficient role or plan, 404 as absent or tenant-hidden, 409 as a reviewed-state conflict, 429 as bounded capacity, and 503 as temporary unavailability. Preserve idempotency keys for the same operation and do not turn an ambiguous mutation into a new request identity.