Headless API · Availability
Deployed alpha. Not supported for production use.
This page separates deployed public reads, local sandbox behavior, deterministic mocks, private production systems, and unavailable developer capabilities.
The public Headless v1 Artist and Catalog GET routes are deployed and require no credential, but they are not currently available for supported production use. Reviewed first-party Casset Apps remain a separate Production / private runtime.
Capability matrix
| Capability | Status | Current truth |
|---|---|---|
| Public artist identity | Deployed / unsupported alpha | The versioned, unauthenticated public identity route is deployed but is not available for supported production use; it may fail closed with 503 RESOURCE_UNAVAILABLE, with no uptime or availability commitment. |
| Public catalog | Deployed / unsupported alpha | The versioned, unauthenticated public Catalog route is deployed but is not available for supported production use; it may fail closed with 503 RESOURCE_UNAVAILABLE, with no uptime or availability commitment. |
| Catalog pagination and filtering | Unavailable | The v1 Catalog response is a single bounded page; cursors and filters are not implemented. |
| Operator Agent API | Production / private | An existing deployment-wide operator key can protect selected automation routes; it is not a developer credential system. |
| Reviewed Casset App Runtime | Production / private | Reviewed first-party Apps run inside Casset's host-owned Artist Runtime. |
| Developer Workbench | Production / private | Authenticated Studio tooling for trusted, browser-local App projects. |
| Framework-neutral TypeScript SDK | Source + local sandbox | Repository-local contracts, parsers, typed errors, and HTTP client; not published to npm. |
| React adapter | Source + local sandbox | Repository-local React bindings over the framework-neutral client. |
| Sandbox developer and App registration | Source + local sandbox | Development-only registration with ephemeral, noncanonical persistence. |
| Sandbox credentials | Source + local sandbox | Development-only credential issuance and immediate local revocation. |
| Sandbox webhooks | Source + local sandbox | Development-only signed delivery, retry, idempotency, and replay rehearsal. |
| Sandbox request inspection | Source + local sandbox | Development-only sanitized request metadata; authorization values and bodies stay hidden. |
| Headless API starter | Source + local sandbox | Executable repository-local starter for the exact sandbox contracts. |
| Local mock host | Mocked | Deterministic local fixture states that implement the public contracts. |
| Production developer credentials | Unavailable | Per-developer production issuance, persistence, grants, and revocation are unavailable. |
| Production App webhooks | Unavailable | Durable production subscriptions, delivery, replay, and audit history are unavailable. |
| Private artist data | Unavailable | Private profiles, unreleased media, fan identity, and commerce data are not exposed. |
| Third-party App submission | Unavailable | External submission, arbitrary bundle execution, and public package distribution are unavailable. |
What the labels mean
| Label | Meaning |
|---|---|
| Production / public | Durable and available as a supported public integration. No current Headless capability has this status. |
| Production / private | Backed by a production owner but restricted to Casset or trusted internal use. Not a developer entitlement. |
| Deployed / unsupported alpha | The unauthenticated public v1 routes exist remotely, but no supported-production-use, uptime, or availability commitment is offered; requests may fail closed with 503. |
| Source + local sandbox | Repository-local packages or loopback-only tooling without remote durability or production support. |
| Mocked | Deterministic fixtures implement the exact public schemas without a live route. |
| Planned | Named intent without an implemented contract. No current registry entry uses this label. |
| Unavailable | No supported capability exists. Source-adjacent concepts or future architecture do not change that. |
Distribution
@casset/appsand@casset/reactare private repository-local alpha packages.- The packages are not published to npm.
- The generated Headless React ZIP vendors both packages as exact local file dependencies.
- Mocks and starter archives are evaluation artifacts, not production credentials or admission tokens.
- There is no public developer account, team, submission, signing, review, or App installation flow.
Local sandbox
The sandbox is disabled in production and rejects non-loopback hosts and origins. Its registration, credentials, webhooks, request history, and idempotency records are process-local. It can prove behavior, but it cannot become a remote or durable service through configuration.
Private production systems
The reviewed Native App Runtime, internal Developer Workbench, and selected operator automation routes have Production / private owners. They are not public Headless endpoints, do not accept sandbox credentials, and do not imply third-party admission or private artist grants.
Unavailable by design today
- Production developer credentials, grants, revocation, and durable audit history.
- Production webhook subscriptions, delivery, retry, replay, and inspection.
- Private profiles, unreleased media, fan identity, analytics, commerce, lyrics, raw media, or playback control.
- Catalog cursors, pagination, and filtering; v1 is one bounded page.
- Public npm distribution and arbitrary third-party App execution.