Skip to main content

Read capability-protected Kanban static resources

GET 
/api/workflows/:workflowName/kanban/previews/:capability/:nonce/:target/:assetPath

Uses the short-lived capability issued by the workspace endpoint to read resources from a fixed version. assetPath may be the configured HTML entry or a multi-segment relative path inside the artifact directory. Directory traversal, symbolic links, sensitive files, and files outside that directory are rejected. The HTML entry injects the configuration and project-data Bridge with a nonce and returns an offline CSP limited to same-artifact resources, data, and blob URLs. The capability itself is a temporary credential scoped to the project, user, fixed target, and expiration time, so a sandboxed iframe can load ES modules, WASM, and project data files without a login cookie or API key. Other project APIs still require login authentication.

Request​

Responses​

HTML, CSS, JavaScript, images, fonts, or other allowed static resources from the project.

Response Headers
    Content-Security-Policy
    X-Content-Type-Options
    Access-Control-Allow-Origin