GET /v1/branding

ការផ្ទៀងផ្ទាត់ភាពត្រឹមត្រូវ

ផ្ញើគ្រាប់ចុច API ជាតូកែន bearer ។ ចំណុចបញ្ចប់នេះមិនបញ្ជាក់ពីសិទ្ធិជាក់លាក់ណាមួយនៅក្នុងការបញ្ជាក់នោះទេ ដូច្នេះសូមផ្ដល់សិទ្ធិអប្បបរមាដែលគ្រាប់ចុចរបស់អ្នកត្រូវការ ហើយពិនិត្យមើលការឆ្លើយតបជំនួសឱ្យការសន្មត់។

សាកល្បង

ជំនួសអ្វីមួយនៅក្នុងសញ្ញាពងក្រពើ < > ដោយប្រើតម្លៃផ្ទាល់ខ្លួនរបស់អ្នក ហើយជំនួសកន្លែងរក្សាទុកសោដោយប្រើសោចេញពីផ្ទាំងគ្រប់គ្រងរបស់អ្នក។

curl -X GET https://api.zinndigital.com/v1/branding \
  -H "Authorization: Bearer zdk_live_…"

បានចូលគណនីរួចហើយមែនទេ? កុងសូល API ក្នុងផ្ទាំងគ្រប់គ្រងរបស់អ្នក បំពេញលេខសម្គាល់ស្ថាប័នពិតប្រាកដរបស់អ្នក និងសោផ្ទាល់ខ្លួនរបស់អ្នក ហើយដំណើរការសំណើទល់នឹង API ផ្ទាល់ ដូច្នេះអ្នកអាចមើលឃើញការឆ្លើយតបពិតប្រាកដ។ បើកចំណុចបញ្ចប់នេះក្នុងកុងសូល API

ព័ត៌មានលម្អិត

The name, logo, colour and links the signed-in customer's dashboard paints itself with — their agency's or reseller's if they are white-labelled, otherwise Zinn®'s. **Always answers, for every authenticated caller.** An organisation with no brand of its own is not a `404`: it receives the platform identity with `is_white_label: false`. A nullable answer would make every client invent its own fallback, and the second such client is the leak this feature exists to close. Resolved by walking **up** the organisation tree to the org that owns the brand, and gated on the `white_label` entitlement held by that owner — never by the client reading it, who holds no such entitlement and never will. ⛔ Not gated on a permission key. This answers *"what does your screen look like?"*, not *"may you see this data?"* — the payload is the brand the caller is already looking at. It is still authenticated and org-scoped, so one tenant cannot ask what another tenant's panel looks like. **`Cache-Control: private, no-store`** — this response is never stored, by any cache, and that is a tenancy requirement rather than a tuning choice. The URL is `/v1/branding` for every tenant and the organisation travels in `X-Zinn-Org`, so a stored copy is keyed on nothing that separates one tenant from the next. It was `private, max-age=60` until 2026-08-26; `private` bounds a stored copy to one browser profile and **does not** bound it to one tenant, and one browser profile is exactly where an organisation switch happens. Measured before the change: four organisations, one token, one second apart, all four answering with the first one's brand. `Vary: X-Zinn-Org, Authorization` is sent as well, so an intermediary that stores despite `no-store` still cannot serve one tenant's brand to another.

ប៉ារ៉ាម៉ែត្រ

ផ្អាកដំណើរការ

កំហុសដែលចំណុចបញ្ចប់នេះអាចបង្វិលត្រឡប់មកវិញ

401 · 429