# Public

> The Public operations of the Hub REST API (3 operations).

URL: https://docs.synap.live/docs/reference/hub-api/public · Generated from Synap-core/backend@c31e261ab (main)

Paths are relative to `/api/hub` on a pod.

## GET /public/projection

Unauthenticated, field-whitelisted public projection of a workspace

Read-only search over the facet-scoped public data a workspace opts into via settings.publicProjection. No auth. Returns 404 when the workspace has not opted in.

Parameters:

| Name | In | Type | Required | Description |
|---|---|---|---|---|
| `workspace` | query | string | yes | Target workspace id (uuid). |
| `q` | query | string |  | Optional keyword filter (matched on title + preview). |
| `role` | query | string |  | Optional single facet role slug to narrow to. Ignored unless it is within the workspace's configured public role allowlist. |
| `limit` | query | string |  | Page size. Default 20, hard-capped at 50. |

Responses:

- `200`: Field-whitelisted projection items
- `400`: Bad request
- `404`: No public projection for this workspace
- `500`: Internal error

## GET /public/shares/{token}

Read a published share (credentialless)

Returns the publish-time snapshot and pinned revision of a PUBLISHED public share. No auth; cross-origin readable; no credentials honoured. Unknown, revoked, expired and unpublished tokens all return the same 404.

Parameters:

| Name | In | Type | Required | Description |
|---|---|---|---|---|
| `token` | path | string | yes | The public share token (the capability). Stored hashed; every miss is the same 404. |

Responses:

- `200`: The published share
- `304`: Not modified (If-None-Match matched the pinned revision)
- `403`: The share is live but its workspace's public pages are switched off (body code `public_doors_disabled`; never used for a miss)
- `404`: Not found (every kind of miss)
- `500`: Internal error

## GET /public/sites/{siteToken}

Read a published site's manifest (credentialless)

Returns a PUBLISHED site's public metadata and its configured collections. No auth; cross-origin readable; no credentials honoured. Unknown, revoked, unpublished and deleted-project tokens all return the same 404.

Parameters:

| Name | In | Type | Required | Description |
|---|---|---|---|---|
| `siteToken` | path | string | yes | The site token (the capability). Stored hashed; every miss is the same 404. |

Responses:

- `200`: The site manifest
- `304`: Not modified (If-None-Match matched)
- `403`: The site is live but its home workspace's public pages are switched off (body code `public_doors_disabled`; never used for a miss)
- `404`: Not found (every kind of miss)
- `500`: Internal error