Public
Endpoints that answer without a token: plans, public walls and reports, profiles.
List plans
No login: plans with monthly/yearly prices, savings, trial days, `featured` (highlighted as Recommended), included usage, limits (incl. storage_retention_days), credit pack range, compute unit price, developer share
Create contact sale
No login: the pricing page's 'Request a demo / contact sales' form. Stored as a form submission and a sales lead; Lantfly staff are notified. Rate limited per IP (3/min, 20/day). A non-empty honeypot `website` gets the same 201 and stores nothing. 404 while Lantfly staff switched the form off
Public campaign report
Public campaign report (no auth, 60/min); `branding` is the agency white-label when the project belongs to an agency client
Public, no sign-in
Public, no sign-in: a profile its owner made public (username, name, avatar_url, bio, readme, links, email only when show_email, member_since). 404 otherwise
Public, no sign-in
Public, no sign-in: a profile picture by its random, unlisted file name
Get host
Public: { custom, branding, registration_open, turnstile_site_key, terms_version, trusted_device_days } — trusted_device_days: the 2FA step offers `remember_device` for this many days (0: not offered); turnstile_site_key: render Cloudflare Turnstile on sign-up and send its token as `turnstile_token` to POST /csl/auth/v1/register (null: no challenge); register also needs `terms_accepted: true` and refuses throwaway inboxes (422 email); whether the request came in on an agency's verified domain (then only /api/public/reports|walls|branding/* and this answer there; everything else 404, no cookies, no redirects); registration_open: self sign-up (/signup) is open (never on an agency domain)
Click referral
Public: the dashboard counts a referral link visit once per browser. Always 204, known code or not. 20/min
An agency's logo
An agency's logo (public, cached a day; nosniff)
Public, read-only wall of a shared project
Public, read-only wall of a shared project (project: { name, description, platforms: the platforms it has visible posts of }; no auth, 120/min; ?platform, ?sort=recent|top, ?q text search of 2-100 characters, at most 20 searches/min per IP)