Shark Tank Control API

GET /api/health

Liveness probe

Returns module name and server time.

Responses

GET /api/tank

List joinable tanks

Stable catalog of ocean-named tanks with live player counts and top score. One earlier path name still reaches this same handler.

Responses

GET /api/leaderboard

Global leaderboard

Top scores across all tanks, persisted by the control plane.

Responses

GET /api/profile

Read a player profile

Parameters

Responses

GET /room/{id}/ws

Realtime play (WebSocket upgrade)

Upgrades the connection (HTTP 101) into the tank's realtime Room. **Client → server** messages: `{t:'hello',name,skin,debugLanguage}`, `{t:'debug',language}` (selected TypeScript/PHP capture tag), `{t:'input',action}` (action = setHeading/setBoost/rocket/respawn), `{t:'ping',ts}`. **Server → client**: `welcome`, `state` (per-tick snapshot), `leaderboard`, `died`, `pong`.

Parameters

Responses

GET /docs/

API documentation (this page)

Renders this OpenAPI document as HTML. Raw document at /docs/openapi.json.

Responses

GET /docs/openapi.json

OpenAPI document

This document. Also served at `/openapi.json`, which is the path the conformance register's evidence index links to.

Responses

GET /trust/

Trust and operations overview

The entry point to the published evidence: availability, incidents, metered spend, conformance readiness, the last deployment and the receipt chain verdict. Every figure is computed from the same source the owning page uses and links to it; none is stored a second time.

Responses

GET /roadmap/

Change record (moved)

Permanently redirects to `/status/#delivery`, where the change record now lives. `/roadmap.json` did not move and is unchanged.

Responses

GET /roadmap.json

Mission and feature-to-deployment map (JSON)

Responses

GET /status/

Operations dashboard

Operations. Server and tank availability, live tank occupancy with the computer-controlled agent count beside it, state copies and restore drills, the full incident record at `#incidents`, the append-only control receipt chain at `#control-history`, and the change record at `#delivery`. Spend is at `/spend/`; operator controls are behind authentication at `/admin/`.

Responses

GET /status.json

Status (JSON)

Responses

GET /incidents/

Incident record (moved)

Permanently redirects to `/status/#incidents`. `/incidents.json` did not move and is unchanged.

Responses

GET /incidents.json

Public incident and control history (JSON)

Responses

GET /spend/

Cost and capacity meters

Links normal game and operations actions to measured Workers, Durable Objects, D1 and R2 usage, against each free-tier allowance and against the hard spend limit that closes the game rather than billing. Previously served at `/inquiry/`, which still redirects here.

Responses

GET /spend.json

Cost and capacity meters (JSON)

Also served at `/inquiry.json`, the pre-rename name, which is unchanged.

Responses

GET /inquiry/

Cost and capacity meters (moved)

Permanently redirects to `/spend/`.

Responses

GET /logs/

Public reason-coded logs

Searchable, filterable service evidence with 90-day retention plus the 40 newest reason-coded captures per ocean tank and sanitized TXT downloads.

Responses

GET /logs.json

Public service and tank logs (JSON)

Every row includes a letter-plus-three-digit reason code. Tank records use the same timestamp, reasonCode, tick, action, language, name, and details fields as the live inspector and TXT export.

Responses

GET /logs/game/{id}.txt

Download a sanitized Shark Tank log

Plain UTF-8 text with timestamp,reason_code,tick,action,language,name,details comma-separated fields and newline-separated records. Internal player ids are omitted.

Parameters

Responses

GET /audit/

ISO/IEC 27001 and ISO/IEC 42001 conformance register

Public, unauthenticated readiness register: every clause of ISO/IEC 27001:2022 and ISO/IEC 42001:2023, all 93 Annex A controls, all 38 AI controls, the fourteen documented change-management processes, the Stage 1 documented-information list, and an index of every route that serves as evidence. Each row carries a status, the justification behind it, and links to the live routes that prove it. This is a readiness statement, not a certificate.

Responses

GET /audit/manifest.json

Conformance register (JSON)

The same register as machine-readable data, for independent scoring or import into a compliance tool.

Responses

GET /policies/

Governance policy index

The index of the written record ISO/IEC 27001:2022 and ISO/IEC 42001:2023 ask for, published as pages rather than filed. Each document is its own route at `/policies/{document}/`, searchable from here, and every section within a document has its own anchor.

Responses

GET /policies/{document}/

One governance document

A single document — context and scope, the information security policy, roles and authorities, the risk assessment and treatment processes, the Statement of Applicability cover, the risk treatment plan, the security and AI objectives, the AI policy with its impact assessment, the AI system life cycle, and the rest. Each names the clauses it is the record for, and the conformance register links to it directly. The document identifier is the `id` field in `/policies.json`.

Parameters

Responses

GET /policies.json

Governance policy set (JSON)

The same documents as machine-readable data: reference, identifier, the route it is published at, title, purpose, the clauses each satisfies, its sections with their anchor ids, and what triggers its review.

Responses

GET /admin/

Operations control panel

Protected HTML dashboard for action records, measured billing counters, billing reset, and maintenance mode. Formerly served at /audit/, which is now the public conformance register.

Responses

GET /admin/log.json

Action log (JSON array)

90-day user and service action record. Also served at the pre-move path /audit.json.

Parameters

Responses

GET /admin/log.jsonl

Action log (newline-delimited JSON)

Also served at the pre-move path /audit.jsonl.

Responses

GET /admin/game/{id}.jsonl

Authenticated replayable room action log

Seed plus the ordered action stream for one tank — the ISO/IEC 42001 A.6.2.8 event record. Also served at /audit/game/{id}.jsonl.

Parameters

Responses

GET /admin/replay/{id}

Reconstruct a room at a retained tick

Deterministic reconstruction of authoritative state, including every autonomous agent, at a chosen tick. Also served at /audit/replay/{id}.

Parameters

Responses

GET /admin/status.json

Private operational status and billing data

The unredacted operational record, including the running version identifier and instance residency. Also served at /audit/status.json.

Responses