Guide
Authentication
The public endpoint needs no credentials. The operator registry (/v1/registry/*) requires a domain-administrator access token.
Which endpoints need auth
| Surface | Paths | Auth |
|---|---|---|
| public | /v1/summary | None |
| operator | /v1/registry/summary/v1/registry/origins/v1/registry/origins/{originId}/v1/registry/addresses/{address} | Domain administrator |
Presenting a token
An access token is accepted two ways. The Authorization header is checked first, then the session cookie.
1 · Bearer header
curl -H "Authorization: Bearer <access_token>" \
https://api.os.tv/v1/registry/summary2 · Session cookie
Browsers that already hold an OS.TV session send the access_token cookie automatically.
curl --cookie "access_token=<access_token>" \
https://api.os.tv/v1/registry/summaryAuthorization model
The token is verified, then the caller must be a global platform admin or a domain administrator.
| Caller | Status | Body |
|---|---|---|
| No / invalid token | 401 | { "error": "Unauthorized" } |
| Valid token, not an admin | 403 | { "error": "Domain admin access required", … } |
| Global or domain admin | 200 | Registry payload |
Tokens are short-lived. Treat a
401 as "refresh and retry", and a 403 as "this identity is authenticated but lacks the domain-admin role" — the two are not interchangeable. See Errors.Obtaining a token is handled by the OS.TV platform sign-in, not by this API — the API only verifies tokens, it does not issue them.