platform-settings
Operations of the Biome Host API. Paths are relative to your deployment's API host.
GET /api/biome-host-api/platform/settings/remote-biome-origins
List the deployment-global trusted remote-biome origins (the CSP remote-origin allowlist). PUBLIC/auth-bypassed: the host-web edge fetches this without a bearer to build the browser CSP header; the value is non-secret (it is emitted in that header).
Authentication: bearer token (Authorization: Bearer <token>)
| Status | Description | Body |
|---|---|---|
| 200 | application/json object | |
| 400 | application/problem+json ProblemDetailsDto | |
| 401 | application/problem+json ProblemDetailsDto | |
| 403 | application/problem+json ProblemDetailsDto | |
| 404 | application/problem+json ProblemDetailsDto | |
| 409 | application/problem+json ProblemDetailsDto | |
| 422 | application/problem+json ProblemDetailsDto | |
| 500 | application/problem+json ProblemDetailsDto |
POST /api/biome-host-api/platform/settings/remote-biome-origins
Add (idempotent) a trusted remote-biome origin. Admin-only. The origin is normalized server-side to its canonical scheme://host[:port]; a malformed value is rejected 400. Returns the full sorted allowlist.
Authentication: bearer token (Authorization: Bearer <token>)
Request body: application/json AddRemoteBiomeOriginDto
| Status | Description | Body |
|---|---|---|
| 200 | application/json object | |
| 400 | application/problem+json ProblemDetailsDto | |
| 401 | application/problem+json ProblemDetailsDto | |
| 403 | application/problem+json ProblemDetailsDto | |
| 404 | application/problem+json ProblemDetailsDto | |
| 409 | application/problem+json ProblemDetailsDto | |
| 422 | application/problem+json ProblemDetailsDto | |
| 500 | application/problem+json ProblemDetailsDto |
DELETE /api/biome-host-api/platform/settings/remote-biome-origins
Remove a trusted remote-biome origin. Admin-only. Idempotent (removing an absent origin is a no-op). Returns the full sorted allowlist.
Authentication: bearer token (Authorization: Bearer <token>)
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
origin | query | string | yes | The origin to remove. Normalized the same way as on add, so any equivalent form matches. |
| Status | Description | Body |
|---|---|---|
| 200 | application/json object | |
| 400 | application/problem+json ProblemDetailsDto | |
| 401 | application/problem+json ProblemDetailsDto | |
| 403 | application/problem+json ProblemDetailsDto | |
| 404 | application/problem+json ProblemDetailsDto | |
| 409 | application/problem+json ProblemDetailsDto | |
| 422 | application/problem+json ProblemDetailsDto | |
| 500 | application/problem+json ProblemDetailsDto |