Read a settings document

GET 
/admin/settings/:category

A secret field never comes back. In its place the document carries "<field>Set": true or false, and the value itself is sealed at rest. There is no route that reads a secret back, on any surface.

The category set is CLOSED: an unknown one is a 404, not a new document. softswiss, webhook and gameurls are per casino; lobby is the instance's and is super-user only, because it describes how this instance runs a battle rather than one casino's credentials.

gameurls.allowedHosts is the list of hosts this casino's seats may be pointed at. It is a security control, not a convenience: the recorder drives a real browser to a seat's game_url and publishes the frames as HLS, so an unconstrained host records whatever that host serves. An EMPTY list means unrestricted, which is what every casino integrated before this document existed still reads — configure it.

A category that has never been saved answers its defaults rather than a 404 — the document exists as a shape whether or not a row does.

Permission: settings.read on a tenant category · super-user on lobby

Request

Responses

200

The document, with every secret replaced by a presence flag

400

X-Tenant-Id is missing on a tenant category

401

No session cookie, or it expired

403

The role lacks settings.read, the caller is not a member of this casino, or the category is platform-scoped and the caller is not a super-user

404

Unknown category — answered only after authentication, so the category list cannot be probed