API

Public reads are JSON with open CORS. Writes need a wallet session (Sign-In-With-Solana style: a message, never a transaction).

Method	Path	What	Access
POST	/api/locus	Read an address: { address, save? } → its 128 letters, its locus and Ensembl's reading. Saving needs a session for that wallet.	30/min per IP
GET	/api/loci?limit=&before=	The ledger: saved loci, newest first.	public, CORS
GET	/api/loci/{n}	One saved locus with its reading.	public, CORS
PUT	/api/loci/{n}/composition	Save the strand's design: { layout: helix\|ribbon\|grid, ground: paper\|ink, title }. Owner only.	session
GET	/api/wallet/{address}	The locus a wallet saved, if any.	public, CORS
GET	/api/genome	The holder genome: every saved locus, the 1 Mb bins and bands they light, and the coverage.	public, CORS
GET	/api/config	Phase (pre-launch or live), the coin's mint, the Ensembl release.	public, CORS
POST	/api/auth/nonce	Start sign-in: { address } → a message to sign.	20/min per IP
POST	/api/auth/verify	Finish sign-in: { address, message, signature } → session cookie.	20/min per IP
GET	/api/me	Your session, holder status and saved locus.	session
POST	/api/auth/logout	End the session.	session
POST	/api/admin/cron	Run the cron's work now (idempotent).	admin token