One published showcase entry
One published showcase entry, as the **public** shape. **No bearer token is required.** The public shape has no `ownerId` and no `status` field at all, rather than nullable ones: a public entry is published by construction, and the identity of the creator is not on the wire in any form, so there is nothing to filter and nothing to leak. A draft, a withdrawn entry, a foreign entry, and a slug that never existed all answer with the same 404.
One published showcase entry, as the public shape. No bearer token is required. The public shape has no ownerId and no status field at all, rather than nullable ones: a public entry is published by construction, and the identity of the creator is not on the wire in any form, so there is nothing to filter and nothing to leak. A draft, a withdrawn entry, a foreign entry, and a slug that never existed all answer with the same 404.
Path Parameters
^[a-z0-9][a-z0-9-]*[a-z0-9]$1 <= length <= 64Response Body
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/showcase/string"{ "id": "string", "slug": "string", "kit": "business", "title": "string", "summary": "string", "projectUrl": "string", "chain": "ethereum", "token": "string", "templateOptIn": true, "remixCount": 0, "publishedAt": "string"}The public showcase listing GET
Every **published** showcase entry, newest publication first. **No bearer token is required** — a showcase anyone can read is the whole point of the public artifact loop (§6.1 loop 1). Only entries whose creator opted in appear. A draft, a withdrawn entry, and a foreign entry are all absent, and their absence is indistinguishable: this route has no owner dimension, so it cannot reveal that a particular person has unpublished work. The `total` field counts everything matching the filter, not the page, so a client can tell "that is all of them" from "that is the first page".
The public showcase page GET
The entry's public page, as HTML. **No bearer token is required** — this is the link a creator pastes into a README, a bio, or a DM, and a page that asked a reader to log in would not be a page anyone shares. The page carries the "Molded with putty" badge (linked back to itself), the entry's own facts, and — when the entry names a chain and a token — links to the two proof surfaces putty already serves: the Receipts page and the Scan page carrying the Verify label. The page renders neither of them, because both are already served by the modules that own them and a second copy would be a second thing to keep true. The page is static HTML with no script and a `Content-Security-Policy` that forbids scripts outright. Every creator-supplied string on it — the title, the summary, the project URL, the token symbol — is HTML escaped, and every link is restricted to `https` (or loopback in dev), so neither a title nor a stored URL can smuggle a `javascript:` scheme or a tag into a page its creator will paste elsewhere. A draft, a withdrawn entry, and a missing slug are the same 404.