---
title: "Resolve stable host/path diagnostics"
method: GET
path: "/apply/v1/resolve"
tags: ["Apply"]
---

# Resolve stable host/path diagnostics

`GET /apply/v1/resolve`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/apply/v1/resolve`
- Auth: API key in header `apikey`

Diagnose how a project-owned stable host and path resolve against the current live release. Returns binding status, release id/generation, route and static manifest SHAs, static manifest metadata, normalized path, match kind, static SHA, cache class/policy, CAS authorization result, response variant diagnostics when applicable, fallback state, legacy immutable risk, edge_propagation diagnostics for eventually consistent edge stores, and result status. A deployment host of the project adds deployment_status (live, retained or retired), origin_available_until and routes_active, and resolves the path against the deployment's release. Does not expose internal CAS URLs.

## Query parameters

- `host` string, required
- `path` string
- `method` string

## Response `200`

Stable-host resolution diagnostics. Host misses are represented as result=404 in the response body.

- StableHostResolveResponse
  - `hostname` string, required
  - `host_binding_id` string, nullable
  - `binding_status` string, nullable
  - `project_id` string, nullable
  - `channel` string, nullable
  - `release_id` string, nullable
  - `release_generation` integer, nullable
  - `route_manifest_sha256` string, nullable
  - `static_manifest_sha256` string, nullable
  - `static_manifest_metadata` StaticManifestMetadata
    - `file_count` integer, required
    - `total_bytes` integer, required
    - `cache_classes` object, required
    - `cache_class_sources` object, required
    - `spa_fallback` string, nullable, required
  - `normalized_path` string, nullable
  - `static_continuity` StaticContinuity: Automatic one-hour origin availability for previously direct-public non-HTML paths absent from the active release. Cached copies may outlive the deadline. Plans omit the deadline until supersession.
    - `mode` 'absent_public_paths', required
    - `origin_retention_seconds` 3600, required
    - `scope` 'previously_public_non_html', required
    - `source_release_id` string, nullable, required
    - `source_release_generation` integer, nullable, required
    - `retained_path_count` integer, required
    - `origin_available_until` string, date-time, nullable: Omitted for candidate supersessions; null for an active release.
  - `current_host_release_id` string, nullable
  - `current_host_release_generation` integer, nullable
  - `match` 'host_missing' | 'manifest_missing' | 'active_release_missing' | 'unsupported_manifest_version' | 'path_error' | 'none' | 'route_function' | 'route_static_alias' | 'route_method_miss' | 'static_exact' | 'static_index' | 'spa_fallback' | 'retained_public_path' | 'spa_fallback_missing' | 'deployment_host' | 'deployment_retired', required
  - `static_sha256` string, nullable
  - `asset_path` string, nullable: Private release static asset path backing the matched public path. Present only on authenticated diagnostics.
  - `reachability_authority` 'implicit_file_path' | 'explicit_public_path' | 'route_static_alias' | 'null', nullable
  - `direct` boolean, nullable
  - `content_type` string, nullable
  - `cache_class` 'html' | 'immutable_versioned' | 'revalidating_asset' | 'null', nullable
  - `cache_policy` string, nullable
  - `authorized` boolean, required
  - `authorization_result` 'authorized' | 'not_public' | 'not_applicable' | 'manifest_missing' | 'target_missing' | 'active_release_missing' | 'unsupported_manifest_version' | 'path_error' | 'missing_cas_object' | 'unfinalized_or_deleting_cas_object' | 'size_mismatch' | 'unauthorized_cas_object' | 'route_inactive' | 'null', nullable: Static CAS authorization/health result when a static object was matched, or the reason no static object is authorized.
  - `cas_object` object, nullable: CAS object health for matched static objects. Never exposes internal storage URLs.
    - `sha256` string
    - `exists` boolean
    - `expected_size` integer
    - `actual_size` integer, nullable
  - `response_variant` object, nullable: Present for transformed/static HTML responses whose public response identity can vary by hostname.
    - `kind` 'hostname_static_html'
    - `varies_by` string[]
    - `hostname` string
    - `release_id` string, nullable
    - `release_generation` integer, nullable
    - `path` string
    - `raw_static_sha256` string
    - `variant_inputs_hash` string
  - `fallback_state` 'unavailable' | 'active_release_missing' | 'unsupported_manifest_version' | 'negative_cache_hit' | 'path_error' | 'method_not_static' | 'not_used' | 'target_missing' | 'used' | 'not_configured' | 'not_eligible', required
  - `error_code` string, nullable
  - `legacy_immutable_risk` object[]
  - `embedding` SiteEmbeddingSpec: Framing opt-in for the site (tenant-site-embedding). `frame_ancestors` lists platform embedding catalog KEYS, never raw origins; the gateway expands them into the `Content-Security-Policy: frame-ancestors` the host sends and drops `X-Frame-Options`. Catalog: `localhost` (http://localhost:* and http://127.0.0.1:*). Omitted on a later apply = carry the base release's declaration forward; `null` = clear back to the default deny. Unknown keys, duplicates, an empty array, or any other member fail with INVALID_SPEC naming the valid keys.
    - `frame_ancestors` string[], required
  - `noindex` boolean: Whether the release this host serves declared `site.noindex` (every response carries `X-Robots-Tag: noindex, nofollow, nosnippet`).
  - `emergency_fallback` object
  - `edge_propagation` EdgePropagationDiagnostics
    - `binding` string, required
    - `claimed_at` string, date-time, required
    - `kvs_synced_at` string, date-time, nullable, required
    - `kvs_source` 'present' | 'missing' | 'unknown', required
    - `status` 'settled' | 'propagating' | 'sync_pending', required
    - `expected_visible_by` string, date-time, nullable, required
    - `hint` string, required
  - `allow` string[], nullable
  - `route_pattern` string, nullable
  - `target_type` 'function' | 'static' | 'null', nullable
  - `target_name` string, nullable
  - `target_file` string, nullable
  - `host_kind` string, nullable: `deployment` when the host is a deployment host (`dpl-*.sites.run402.com`); absent for stable hosts.
  - `deployment_id` string, nullable: Deployment hosts: the `dpl_` deployment the host serves.
  - `deployment_status` 'live' | 'retained' | 'retired', nullable: Deployment hosts: `live` while the active release or a subdomain serves the deployment, `retained` once replaced (serving until `origin_available_until`), `retired` after that deadline (every request answers 404).
  - `origin_available_until` string, date-time, nullable: Deployment hosts: when a replaced deployment stops (or stopped) serving; null while live.
  - `origin_retention_seconds` integer, nullable: Deployment hosts: how long a replaced deployment keeps serving (3600).
  - `path_evaluated` boolean: Deployment hosts: `true` when the path was resolved against the deployment's release (its static manifest and public paths); `false` for a retired host or a deployment no release names, reported per host.
  - `route_gates` string[]: Function routes: what stands before the function's response (`require_auth`, `require_role`, `priced`); empty when anyone reaches it. `authorized: true` on a function route means the host dispatches the request to the function.
  - `routes_active` boolean: Deployment hosts: `false` once the deployment was replaced; its routes no longer run there and a matched route reports result 404.
  - `result` integer, required

## Other responses

- `400`: Invalid host/path resolve request.
- `403`: API key does not own the resolved host's project.

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)