---
title: "Serve Dashboard"
method: GET
path: "/index.html"
---

# Serve Dashboard

`GET /index.html`

## Request

- Base URL: `https://www.oxfordledge.com` (the document declares no server; this is the origin it was published from)
- URL: `https://www.oxfordledge.com/index.html`
- Auth: none declared

Serve the main dashboard. Generates a per-request CSP nonce, stashes
it on `request.state.csp_nonce` so `middleware/headers.py` can echo it
into the SPA style-src directive, and substitutes the
`__OL_CSP_NONCE__` placeholder in `dashboard.html`'s inline `<style>`
tag with that same value. Both halves of the nonce contract land
together — if either is missing, the inline critical-CSS block won't
apply and the page renders unstyled.

Injects browser Sentry DSN inline when SENTRY_DSN_BROWSER is configured
so frontend error tracking works without an extra boot fetch.

S55 (2026-04-28): anonymous landings on the BARE root URL (no query
string) used to 302-redirect to /welcome. 2026-04-30 GSC audit fix:
inline-render the welcome content at / instead so Googlebot
stops classifying / as a redirector ("Page with redirect" was 1
of 3 such GSC warnings). Both / and /welcome now render the same
content for anon visitors, with `<link rel="canonical" href="/">`
in the template so Google indexes / and treats /welcome as alias.
Auth users still get the dashboard at /; anon-with-query-string
still gets the SPA so deep-link intent is preserved.

## Response `200`

Successful Response

---

[API](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api.md) · [All operations](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/llms.txt) · [OpenAPI document](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/revisions/e832a1260f0b?raw)