API
Public reads are JSON with open CORS. Writes need a wallet session (Sign-In-With-Solana style: a message, never a transaction).
| Method | Path | What | Access |
|---|---|---|---|
| POST | /api/reveal | { address, save? } → the pick (SHA-256 → index → GVP volcano number), holders, your claim. Saving needs a session for that wallet. | 60/min per IP |
| GET | /api/live | The live layer: USGS elevated volcanoes (US only) and the Smithsonian / USGS Weekly Volcanic Activity Report, with fetch times. | public, CORS |
| GET | /api/ring | Every claimed volcano with its holder count, and coverage of the 1,214. | public, CORS |
| GET | /api/claims?limit=&before=&vnum= | Saved claims, newest first (optionally for one volcano). | public, CORS |
| GET | /api/claims/{n} | One claim. | public, CORS |
| GET | /api/wallet/{address} | The volcano an address maps to now, and its claim if saved. | public, CORS |
| GET | /api/volcano/{number} | One volcano's record (GVP), holders and live status. | public, CORS |
| PUT | /api/claims/{n}/card | Save the card: { style: survey|poster|glow, label }. Owner only. | session |
| POST | /api/auth/nonce | Start sign-in: { address } → a message to sign. | 20/min per IP |
| POST | /api/auth/verify | Finish sign-in: { address, message, signature } → session cookie. | 20/min per IP |
| GET | /api/me | Your session, phase and claim. | session |
| POST | /api/auth/logout | End the session. | session |
| POST | /api/admin/cron | Run the background job now (idempotent). | admin token |