The public showcase page
The entry's public page, as HTML. **No bearer token is required** — this is the link a creator pastes into a README, a bio, or a DM, and a page that asked a reader to log in would not be a page anyone shares. The page carries the "Molded with putty" badge (linked back to itself), the entry's own facts, and — when the entry names a chain and a token — links to the two proof surfaces putty already serves: the Receipts page and the Scan page carrying the Verify label. The page renders neither of them, because both are already served by the modules that own them and a second copy would be a second thing to keep true. The page is static HTML with no script and a `Content-Security-Policy` that forbids scripts outright. Every creator-supplied string on it — the title, the summary, the project URL, the token symbol — is HTML escaped, and every link is restricted to `https` (or loopback in dev), so neither a title nor a stored URL can smuggle a `javascript:` scheme or a tag into a page its creator will paste elsewhere. A draft, a withdrawn entry, and a missing slug are the same 404.
The entry's public page, as HTML. No bearer token is required — this is the link a creator pastes into a README, a bio, or a DM, and a page that asked a reader to log in would not be a page anyone shares. The page carries the "Molded with putty" badge (linked back to itself), the entry's own facts, and — when the entry names a chain and a token — links to the two proof surfaces putty already serves: the Receipts page and the Scan page carrying the Verify label. The page renders neither of them, because both are already served by the modules that own them and a second copy would be a second thing to keep true. The page is static HTML with no script and a Content-Security-Policy that forbids scripts outright. Every creator-supplied string on it — the title, the summary, the project URL, the token symbol — is HTML escaped, and every link is restricted to https (or loopback in dev), so neither a title nor a stored URL can smuggle a javascript: scheme or a tag into a page its creator will paste elsewhere. A draft, a withdrawn entry, and a missing slug are the same 404.
Path Parameters
^[a-z0-9][a-z0-9-]*[a-z0-9]$1 <= length <= 64Response Body
text/html
application/json
application/json
application/json
curl -X GET "https://example.com/showcase/string/page""string"One published showcase entry GET
One published showcase entry, as the **public** shape. **No bearer token is required.** The public shape has no `ownerId` and no `status` field at all, rather than nullable ones: a public entry is published by construction, and the identity of the creator is not on the wire in any form, so there is nothing to filter and nothing to leak. A draft, a withdrawn entry, a foreign entry, and a slug that never existed all answer with the same 404.
The "Molded with putty" badge GET
The entry's "Molded with putty" badge, as an SVG. **No bearer token is required.** The badge is a link, not a picture: the SVG wraps its contents in an `<a>` pointing at the entry's public page, which is what makes §6.1 loop 1's "each links back" true rather than aspirational. There is no way to obtain a badge for something that is not published, because the badge and the page resolve through the same published-only read. The title is drawn beside the mark when it is short enough to read and is dropped when it is not, so a long title is a clean badge rather than a clipped smear. The title is XML-escaped, and the link's scheme is restricted to `https` (or loopback in dev), so a title or a stored URL cannot inject markup or a `javascript:` href into a badge that other people's pages will embed. A draft, a withdrawn entry, and a missing slug are the same 404.