API
Public reads are JSON with open CORS. Writes need a wallet session (Sign-In-With-Solana style: a message, never a transaction).
| Method | Path | What | Access |
|---|---|---|---|
| POST | /api/digs | Dig at an address: { address, save? } → the pin, the ground (Macrostrat), the find (PBDB, PhyloPic). Saving needs a session for that wallet. | 30/min per IP |
| GET | /api/fossils?limit=&before= | Saved fossils, newest first. | public, CORS |
| GET | /api/fossils/{n} | One saved fossil with its dig. | public, CORS |
| GET | /api/wallet/{address} | The fossil a wallet saved, if any. | public, CORS |
| GET | /api/timeline | Every saved fossil on the deep-time ruler, and the ICS stages they cover. | public, CORS |
| GET | /api/silhouette/{uuid}.svg | A PhyloPic silhouette chosen by a dig, served from this origin (licence and credit come with the dig). | public |
| PUT | /api/fossils/{n}/card | Save the card: { style: field|tag|core, label }. Owner only. | session |
| POST | /api/auth/nonce | Start sign-in: { address } → a message to sign. | 20/min per IP |
| POST | /api/auth/verify | Finish sign-in: { address, message, signature } → session cookie. | 20/min per IP |
| GET | /api/me | Your session, phase, holder tier and fossil. | session |
| POST | /api/auth/logout | End the session. | session |
| POST | /api/admin/cron | Run the cron now (idempotent). | admin token |
Try /api/timeline or /api/fossils.