> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrqen.cc/llms.txt
> Use this file to discover all available pages before exploring further.

# Fetch the signed release manifest

> Serves the signed manifest verbatim from `UPDATE_MANIFEST_PATH`. The server never signs on demand and never returns executable content: the client verifies the ed25519 signature and the artifact digest locally, and refuses downgrades, stale manifests, and revoked versions, before anything is written to disk.

The payload shape is `schemas/update-manifest.schema.json`. Cached for 5 minutes.



## OpenAPI

````yaml /api-reference/openapi.json get /api/v1/updates/manifest
openapi: 3.1.0
info:
  title: Myrqen API
  version: 1.0.0
  description: >-
    The JSON API served by `apps/web` under `/api/v1`. Derived from the route
    handlers in `apps/web/app/api/v1` and the shared types in
    `packages/contracts`.


    This reference documents the surface a developer and the Myrqen CLI actually
    use. Platform-administration and billing endpoints exist in the application
    but are operator-only and are deliberately not published here.


    The hosted service at `https://api.myrqen.cc` is not deployed yet. Run your
    own deployment and use its origin.
  license:
    name: Myrqen Source-Available Licence 1.0
    url: https://github.com/stijnswapped/Myrqen/blob/main/LICENSE
servers:
  - url: http://localhost:3000
    description: >-
      A deployment you run yourself. Use this while the hosted service is
      unavailable.
  - url: https://api.myrqen.cc
    description: >-
      The hosted API. This is the CLI's shipped default, but the hosted service
      is NOT deployed yet, so requests to it do not resolve today.
security: []
tags:
  - name: Health
    description: >-
      Liveness and readiness probes. Unauthenticated, and answered on any
      hostname.
  - name: Authentication
    description: Browser sessions. Password plus recovery codes; no email is ever sent.
  - name: Device linking
    description: Binding a machine's CLI to an account, via browser approval.
  - name: Workspaces and projects
    description: Where a scanned repository belongs.
  - name: Sync and quota
    description: Creating, feeding, and finalizing a cloud report.
  - name: Reports
    description: Reading and exporting a synced report.
  - name: Sharing
    description: Share links and the server-side projections they resolve to.
  - name: Analytics
    description: Allowlisted product-event ingest.
  - name: Updates
    description: The signed release manifest.
paths:
  /api/v1/updates/manifest:
    get:
      tags:
        - Updates
      summary: Fetch the signed release manifest
      description: >-
        Serves the signed manifest verbatim from `UPDATE_MANIFEST_PATH`. The
        server never signs on demand and never returns executable content: the
        client verifies the ed25519 signature and the artifact digest locally,
        and refuses downgrades, stale manifests, and revoked versions, before
        anything is written to disk.


        The payload shape is `schemas/update-manifest.schema.json`. Cached for 5
        minutes.
      operationId: getUpdateManifest
      responses:
        '200':
          description: The signed manifest, byte for byte as published.
          content:
            application/json:
              schema:
                type: object
        '404':
          description: >-
            `NOT_FOUND` — no signed release manifest is published in this
            environment.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
      security: []
components:
  schemas:
    ApiError:
      type: object
      required:
        - error
      properties:
        error:
          type: object
          required:
            - code
            - message
            - requestId
          properties:
            code:
              $ref: '#/components/schemas/ApiErrorCode'
            message:
              type: string
              description: Human-readable. May change; branch on `code`.
            requestId:
              type: string
              description: A fresh UUID per response, for correlating with server logs.
            details:
              type: object
              additionalProperties: true
      example:
        error:
          code: SYNC_WEEKLY_LIMIT_REACHED
          message: Cloud report limit reached. This scan stays local.
          requestId: 8f14e45f-ceea-467a-9f8b-2b6b2b6a1f2c
          details:
            weekly:
              used: 15
              limit: 15
              resetsAt: '2026-08-24T06:00:00.000Z'
    ApiErrorCode:
      type: string
      enum:
        - BAD_REQUEST
        - VALIDATION_FAILED
        - UNAUTHENTICATED
        - FORBIDDEN
        - NOT_FOUND
        - CONFLICT
        - RATE_LIMITED
        - INTERNAL
        - DEVICE_LINK_EXPIRED
        - DEVICE_LINK_ALREADY_CONSUMED
        - DEVICE_LINK_NOT_APPROVED
        - DEVICE_REVOKED
        - SYNC_DAILY_LIMIT_REACHED
        - SYNC_WEEKLY_LIMIT_REACHED
        - REPORT_EXPIRED
        - REPORT_SCHEMA_UNSUPPORTED
        - UNSAFE_PAYLOAD_REJECTED
        - SHARE_PASSWORD_REQUIRED
        - SHARE_NOT_AVAILABLE
        - CLIENT_VERSION_REVOKED
        - CLIENT_VERSION_TOO_OLD
        - SUPPORT_GRANT_REQUIRED

````