API
Public reads are JSON with open CORS. Writes need a wallet session (Sign-In-With-Solana style: a message, never a transaction).
| Method | Path | What | Access |
|---|---|---|---|
| POST | /api/falls | Draw the meteorite for an address: { address, save? } → the pick (SHA-256, row), the meteorite, how many saved wallets share it. Saving needs a session for that wallet. | 30/min per IP |
| GET | /api/rows/{k} | Row k (1 to 45,716) of the pinned index, as the page reads it. | public, CORS |
| GET | /api/wallet/{address} | The meteorite an address draws (from the address alone) and its saved specimen, if any. | public, CORS |
| GET | /api/specimens?limit=&before= | Saved specimens, newest first. | public, CORS |
| GET | /api/specimens/{n} | One saved specimen with its meteorite. | public, CORS |
| GET | /api/sky | Every saved specimen at its real impact point, and the share of the 45,716 claimed. | public, CORS |
| GET | /api/fireball | The newest located fireball in NASA/JPL CNEOS's record (cached for 3 hours). | public, CORS |
| PUT | /api/specimens/{n}/card | Save the card: { style: label|night|slice, label }. Owner only. | session |
| POST | /api/auth/nonce | Start sign-in: { address } → a message to sign. | 20/min per IP |
| POST | /api/auth/verify | Finish sign-in: { address, message, signature } → session cookie. | 20/min per IP |
| GET | /api/me | Your session, phase and specimen. | session |
| POST | /api/auth/logout | End the session. | session |
| POST | /api/admin/cron | Run the background jobs now (idempotent). | admin token |
Try /api/rows/1, /api/sky or /api/fireball. The pinned index itself is /data/meteorites-v1.bin (SHA-256 98c4c2307468a413…; the format is in the README).