One listed app

GET 
/public/apps/:slug

The same row as the index, for one listed app; any other slug is 404. Throttle: public/apps/read/ip, 120 a minute — one bucket with the index.

Request

Responses

200

The app.

Response Headers

Cache-Control

Cached five minutes by browsers and CDNs. Every public response also carries Vary: Origin — its CORS headers depend on the caller's origin — so a shared cache keys on it.

Access-Control-Allow-Origin

*, without credentials, for any origin but the ones the app itself is served from: a https://<subdomain>.kudoscrm.com origin is echoed, with Access-Control-Allow-Credentials: true. The apex https://kudoscrm.com gets *. No Origin header, no CORS headers.

400

The request body is not valid JSON.

404

Not found in this workspace — or not something the caller may know exists.

429

A throttle refused the request. Wait Retry-After seconds — the time left in the refusing window plus 0–3 s of jitter. The X-RateLimit-* headers describe the bucket that refused it.

Response Headers

Retry-After
X-RateLimit-Limit
X-RateLimit-Remaining
X-RateLimit-Reset

Seconds until the window rolls.