API Documentation
Overview
OrigamiFalcon exposes a small, proxied API surface through this site. All calls go to /api/* and are forwarded to the upstream API service; /cdn/* is forwarded to the CDN service. Secrets are injected server-side by this Worker; the browser never receives them.
Authentication
Browser traffic to this site needs no token. Server-to-server callers (mobile apps, partners) authenticate with X-Api-Secret or Authorization: Bearer <token>. The /v1/docs endpoint is public and machine-readable. Rate-limited endpoints return HTTP 429 when exceeded.
Endpoints
| Method | Path | Description | Rate limit |
|---|---|---|---|
| GET | / | Service metadata | — |
| GET | /health | Health check | 60/min |
| ALL | /api/* | Proxy to API service | 60/min |
| ALL | /cdn/* | Proxy to CDN service (public reads; writes admin-only) | 300/min |
| GET | /v1/docs | Machine-readable service description (JSON) | 60/min |
| GET | /docs | This page (HTML) | — |
| POST | /api/v1/auth/* | Auth flows (login, signup, refresh) | 5/min |
| POST | /api/v1/payments | Submit payment proof | 3/min |
| GET | /api/v1/public | Anonymous aggregate stats | 60/min |
| GET | /api/v1/plans | Plan catalog | 60/min |
Error codes
Errors return JSON with an error field. Common statuses: 400 (bad request), 401 (unauthenticated), 403 (forbidden), 404 (not found), 429 (rate limited), 500 (internal).
Maintenance status
See the service status page for an at-a-glance health view of the API and CDN nodes.
Last updated: 23 October 2026 · Origami Falcon