Documentation

Response shape

Every data endpoint returns an envelope rather than a bare payload, so callers can tell real telemetry from placeholder data:

{
  "data":        <payload>,
  "origin":      "mock" | "live",
  "generatedAt": "2026-08-26T09:00:00.000Z",
  "error":       "upstream message, when a live provider failed"
}

When origin is mock, the values are generated for the interface and must not be presented as real. The site itself honours this: every screen showing mock data renders a labelled notice.

Data sources

Providers live in src/lib/services/providers. Set DATA_SOURCE=live plus the relevant URL — STATUS_API_URL, BGP_API_URL, LOOKING_GLASS_URL — and the matching provider takes over. If a live call fails, the service falls back to mock and reports the upstream error in error rather than serving stale numbers as fact.

Authentication

The endpoints above are public and read-only. Account endpoints (servers, invoices, tickets) require a session and are not exposed in this build. Credentials are read server-side only; nothing sensitive is prefixed with NEXT_PUBLIC_.

Rate limits

The looking glass validates its target against a strict pattern before any backend call, and is intended to sit behind a per-IP rate limit in production. Status endpoints are cheap and served with cache-control: no-store.