Sign in
LinkMablnet

Resolve the current mablnet worker manifest for the calling Host's channel

Returns the signed release manifest the calling Host should run, after applying the channel's staged-rollout decision for this Host. The manifest body is an opaque, Ed25519-signed document (see manifest-format.md in link/mablnet/docs); the api stores and returns it without altering field values, so the consumer's JCS re-canonicalisation still verifies — see link/mablnet/docs/deployment/release-pipeline-api.md § Opaque signed documents. Rollout resolution (which version this Host receives) is computed server-side from the per-channel rollout state plus a stable per-Host bucket — see § Manifest resolution. Conditional refetch: callers send their last-known ETag as If-None-Match; the server returns 304 Not Modified (no body) when the resolved manifest is unchanged. The current ETag is mirrored in both the ETag header and the mabl-specific x-mabl-entity-version header.

get/link/mablnet/artifacts/{artifact}/manifest

Path parameters

artifactstring required

Release artifact the channel belongs to: mablnet-host (the worker binary) or link-agent (the Java Link Agent bundle). Channels are namespaced per artifact, so stable for one artifact is unrelated to stable for another.

Query parameters

channelstring required

Release channel to resolve against, within the artifact. The well-known channels are latest (newest main build — dev/non-prod) and stable (tag-promoted release — prod); ephemeral per-branch channels named for the branch (sanitised to [A-Za-z0-9._-], as the release workflows publish them) are also accepted, as is a major-version channel such as 3 for the Link Agent. An operator-declared channel alias (see PUT /link/mablnet/artifacts/{artifact}/channels/{channel}/alias) is followed transparently — e.g. a request for dev resolves to latest when that alias is set — so an older client sending a renamed channel keeps working.

host_idstring

Stable per-Host identifier used to bucket this Host within the channel's staged rollout. When omitted, the workspace id from the API key is used, which moves a whole workspace's Hosts together. See design doc § Bucketing identity.

workspace_idstring

Workspace owning the calling Host's tunnel. With label, identifies the Link Label (tenant) whose operator-set worker_release_override is applied before the channel's staged rollout — a tenant pin can redirect the channel and/or pin an exact version. The override is a worker pin and is consulted only for artifact mablnet-host; other artifacts follow the channel rollout regardless. Omit (or omit label) for callers with no tenant pin. See design doc § Per-tenant pin.

labelstring

Link Label (tunnel name) the calling Host belongs to. Paired with workspace_id to resolve the tenant whose worker_release_override is consulted.

Headers

If-None-Matchstring

Last ETag the caller observed; server returns 304 when the resolved manifest is unchanged.

Response

Resolved manifest in body; current ETag in headers.

manifeststring required

Base64 of the exact signed manifest bytes. Decode, then verify + parse per manifest-format.md.

resolved_channelstring

The channel the returned manifest was resolved on, after channel aliasing and any per-tenant release override. Equals the requested channel unless one of those redirected it. A consumer that checks the manifest's signed channel compares it to this, so a renamed channel keeps working; the check catches a manifest moved between channels by a publishing mistake or a middlebox, not a substitution by the api itself, which the signature covers.

Changes

Changed in 2 of the 32 revisions of this API.2