---
title: "Get the active release's CURRENT LIVE state"
method: GET
path: "/apply/v1/releases/active"
tags: ["Apply"]
---

# Get the active release's CURRENT LIVE state

`GET /apply/v1/releases/active`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/apply/v1/releases/active`
- Auth: API key in header `apikey`

Returns the materialized state of the active release as it stands RIGHT NOW (live tables read). A `setSecret()` call between activation and now WILL appear in this response — distinct from `/releases/{release_id}` which returns the activation-time snapshot. The response's `state_kind` field is `"current_live"`. Returns 404 NO_ACTIVE_RELEASE if the project has no active release.

## Query parameters

- `site_limit` integer

## Response `200`

Current-live release inventory

- ReleaseInventory: Materialized release inventory (capability agent-deploy-observability). Used by `GET /apply/v1/releases/{release_id}` (activation-time snapshot) and `GET /apply/v1/releases/active` (current-live state). The `state_kind` field discriminates: `"current_live"` for /releases/active; `"effective"` for active/superseded /releases/{release_id}; `"desired_manifest"` for failed/staged /releases/{release_id} (manifest replay, not snapshot).
  - `static_continuity` StaticContinuity: Automatic one-hour origin availability for previously direct-public non-HTML paths absent from the active release. Cached copies may outlive the deadline. Plans omit the deadline until supersession.
    - `mode` 'absent_public_paths', required
    - `origin_retention_seconds` 3600, required
    - `scope` 'previously_public_non_html', required
    - `source_release_id` string, nullable, required
    - `source_release_generation` integer, nullable, required
    - `retained_path_count` integer, required
    - `origin_available_until` string, date-time, nullable: Omitted for candidate supersessions; null for an active release.
  - `kind` 'release_inventory', required
  - `schema_version` 'agent-deploy-observability.v1', required
  - `release_id` string, nullable, required
  - `project_id` string, required
  - `parent_id` string, nullable
  - `status` 'active' | 'superseded' | 'failed' | 'staged', required
  - `manifest_digest` string, required: Hex-encoded SHA-256 of the canonical manifest.
  - `created_at` string, date-time, required
  - `created_by` string, nullable
  - `actor` OperationActorSnapshot
    - `schema_version` 1, required
    - `principal` PrincipalSnapshot, required
      - `principal_id` string, required
      - `principal_type` string, required
      - `display_name_at_capture` string, nullable, required
      - `linked_identities_at_capture` LinkedIdentitySnapshot[], required
        - `identity_link_id` string, required
        - `kind` string, required
        - `public_subject` string, required
        - `display_subject` string, required
        - `verified_at` string, date-time, required
        - `status_at_capture` 'active', required
    - `authenticator` AuthenticatorSnapshot, required
      - `authenticator_id` string, required
      - `kind` string, required
      - `public_subject` string, required
    - `authority` AuthoritySnapshot, required: Discriminated immutable action-time authority: organization_membership, project_grant, grant_key, ci, system, legacy, or a preserved future kind. A link is never an authority kind.
      - `kind` string, required
      - `org_id` string, nullable
      - `project_id` string, nullable
      - `membership_id` string, nullable
      - `grant_id` string, nullable
      - `grant_key_id` string, nullable
      - `credential_id` string, nullable
      - `role` string, nullable
      - `scope` string[]
      - `reason_code` string, nullable
    - `captured_at` string, date-time, required
  - `activated_at` string, date-time, nullable
  - `superseded_at` string, date-time, nullable
  - `operation_id` string, nullable
  - `plan_id` string, nullable
  - `events_url` string, nullable: Full path to the deploy operation's event stream, if known.
  - `effective` boolean, required: True for active/superseded releases (state was actually realized); false for failed/staged (desired-manifest only).
  - `state_kind` 'current_live' | 'effective' | 'desired_manifest', required
  - `release_generation` integer, nullable, required: Monotonic active-host generation used for cache keys and diagnostics.
  - `deployment_id` string, nullable: The dpl_ site deployment this release serves — what managed subdomain bindings point at and what POST /subdomains/v1 resolves a release_id to. Null for a release that never carried site files.
  - `static_manifest_sha256` string, nullable, required: SHA-256 of the canonical run402.static_manifest.v1 object for this materialized release.
  - `static_manifest_metadata` StaticManifestMetadata, required
    - `file_count` integer, required
    - `total_bytes` integer, required
    - `cache_classes` object, required
    - `cache_class_sources` object, required
    - `spa_fallback` string, nullable, required
  - `embedding` SiteEmbeddingSpec: Framing opt-in for the site (tenant-site-embedding). `frame_ancestors` lists platform embedding catalog KEYS, never raw origins; the gateway expands them into the `Content-Security-Policy: frame-ancestors` the host sends and drops `X-Frame-Options`. Catalog: `localhost` (http://localhost:* and http://127.0.0.1:*). Omitted on a later apply = carry the base release's declaration forward; `null` = clear back to the default deny. Unknown keys, duplicates, an empty array, or any other member fail with INVALID_SPEC naming the valid keys.
    - `frame_ancestors` string[], required
  - `sign_in_path` string, nullable: The app's own sign-in page for MCP authorization (`site.sign_in_path`), or null for the hosted page.
  - `noindex` boolean: Whether the release declared `site.noindex`: every response of the host carries `X-Robots-Tag: noindex, nofollow, nosnippet`.
  - `static_public_paths` StaticPublicPathInventoryEntry[], required: Materialized static public-path entries, including explicit direct paths and route-only static aliases. Empty when there is no static manifest.
    - `public_path` string, required: Canonical browser path, such as /events.
    - `asset_path` string, required: Private release static asset path backing the public path.
    - `reachability_authority` 'implicit_file_path' | 'explicit_public_path' | 'route_static_alias', required
    - `direct` boolean, required: True for ordinary direct static lookup; false for route-only static aliases.
    - `cache_class` 'html' | 'immutable_versioned' | 'revalidating_asset', required
    - `content_type` string, required
    - `route_id` string: Present for route-only static alias entries.
    - `methods` string[]: Effective static methods for route-only entries.
  - `site` object, required
    - `paths` SitePathEntry[], required
      - `path` string, required
      - `content_sha256` string, required: Lowercase hex SHA-256.
      - `content_type` string, required
      - `size_bytes` integer, nullable: Static file byte size when available from CAS metadata.
    - `totals` object: Present ONLY when paths array was truncated by site_limit.
      - `paths` integer
  - `functions` FunctionEntry[], required
    - `name` string, required
    - `code_hash` string, required
    - `runtime` string, required
    - `timeout_seconds` integer, required
    - `memory_mb` integer, required
    - `schedule` string, nullable
    - `tool` FunctionToolEntry: add-app-mcp-endpoint: the function's MCP tool, read at commit from a static `export const tool = { description, input, title?, annotations? }` in its source (parsed, never executed). Served on every host of the project at `/_run402/mcp`; a tool call is a POST to `route`.
      - `name` string, required: The function name, which is the tool name.
      - `description` string, required
      - `title` string
      - `input` object, required: JSON Schema for the tool's arguments; root `type` is `object`.
      - `annotations` object: MCP tool hints: readOnlyHint, destructiveHint, idempotentHint, openWorldHint.
      - `route` string, nullable, required: The one exact POST route the tool binds to.
  - `secrets` object, required
    - `keys` string[], required
  - `subdomains` object, required
    - `names` string[], required
  - `routes` MaterializedRoutes, required: Canonical route manifest for a materialized release, including function routes and exact static URL aliases. A non-null manifest_sha256 indicates the route table is ready for managed-domain and custom-domain lookup.
    - `manifest_sha256` string, nullable, required: SHA-256 of the canonical route table, or null when entries is empty.
    - `entries` RouteEntry[], required
      - `pattern` string, required
      - `kind` 'exact' | 'prefix', required
      - `prefix` string, nullable, required
      - `methods` string[], nullable, required: Null means all supported methods.
      - `target` union, required: Web Route target. Function targets invoke a same-release Node 22 function. Static targets are exact static URL aliases that serve a materialized same-release static site file without redirecting or rewriting the browser URL.
        - object
          - `type` 'function', required
          - `name` string, required: Name of a materialized function in the same release.
        - object
          - `type` 'static', required
          - `file` string, required: Relative materialized static-site file path in the same release. No leading slash, query, fragment, backslash, empty segment, . segment, .. segment, or directory shorthand.
      - `pricing` RoutePricingSpec: Fixed-price tenant x402 policy for a public function web route. Supported only when target.type is function; static aliases cannot be priced. A challenge advertises maxTimeoutSeconds=300. After proof verification, Idempotency-Key (1-255 visible ASCII bytes) is scoped by verified payer, project, route pattern, and method, then bound to the normalized request contract. Same-payer/same-request/same-key retry is the only status/recovery operation. Successful routed responses expose platform-owned X-Run402-Payment-* headers and the x402 v2 PAYMENT-RESPONSE settlement header (base64 JSON SettleResponse: success, transaction, network, payer), on a first delivery and on a deduplicated replay alike; pending and conflict responses use a canonical error envelope. Tenant execution is at-least-once, so handlers should deduplicate durable effects by paymentId.
        - `mode` 'always', required: Every matching request must settle x402 before the handler runs.
        - `amount_usd_micros` integer, required: USD micro-units charged per matching request. 250000 means $0.25.
        - `amount_msat` integer: Pins the Lightning price in millisatoshis for the route's lightning / lightning-testnet entries. Valid only when networks names a Lightning value. Absent, each challenge quotes amount_usd_micros into whole satoshis through the platform Lightning quote; amount_usd_micros stays the ledger amount either way.
        - `pay_to` 'org_default_payout', required: Resolve the owning organization default payout wallet at activation and serve time.
        - `networks` RoutePricingNetwork[]: Optional supported network set. Omitted means mainnet only. A Lightning value requires the organization's Lightning receiver on that network (LIGHTNING_RECEIVER_REQUIRED at activation); a Lightning-only route needs no EVM payout wallet. receipt cannot be combined with a Lightning value.
        - `receipt` 'on_fulfillment': Receipt authoring intent from the public ReleaseSpec contract. Run402 Cloud currently rejects this field at routes.replace.<index>.pricing.receipt before mutation until an interoperable delegated-signer authorization carrier is published; ordinary priced routes remain supported.
        - `discovery` RoutePricingDiscovery: Opt-in x402 Bazaar discovery metadata. When present, the route's 402 challenge carries it (resource description, mimeType, serviceName, tags, iconUrl, extensions.bazaar) plus platform attribution (the tag run402 and accepts[].extra.hosted_by), and the first paid call through the CDP facilitator lists the route in the Bazaar. Allowed only on an exact route with exactly one HTTP method (GET may include HEAD). Canonical JSON of this object is at most 4096 bytes.
          - `description` string, required: What the endpoint does and when to call it. Used verbatim.
          - `mime_type` string: Response media type. Default application/json.
          - `service_name` string: Printable ASCII.
          - `tags` string[]: Printable ASCII. The Bazaar keeps five tags; the platform appends run402 as the fifth.
          - `icon_url` string, uri: Absolute https URL on a public host name, without credentials.
          - `input` object: A GET, HEAD, or DELETE route describes query parameters (query_params_schema, object example); a POST, PUT, or PATCH route describes its body (body_type required). Schemas may reference only local # fragments.
            - `query_params_schema` object
            - `body_type` 'json' | 'form-data' | 'text'
            - `body_schema` object
            - `example` unknown
          - `output` object
            - `example` unknown
            - `schema` object
  - `migrations_applied` MigrationAppliedEntry[], required
    - `migration_id` string, required
    - `checksum_hex` string, required
    - `applied_at` string, date-time, required

## Other responses

- `404`: No active release for this project (NO_ACTIVE_RELEASE).
- `501`: Feature disabled.

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)