The free layer
The thirteen operations that need no bearer at all, and what the free layer deliberately does not include.
Not everything in Putty needs an account. Thirteen operations across the API
answer with no bearer at all — no sk- key, no Privy session, no
dashboard. The OpenAPI document marks each one security: [], so this list is
the document's own, not a summary of it.
This is the surface a person lands on from a link. It is the layer a trader uses before deciding, and the layer a builder can read to learn what Putty knows without creating anything.
The thirteen
| Operation | What it is for |
|---|---|
POST /verify | Verify a contract and get a verdict — the permission diff and a plain-English readback |
GET /verify/methods | What this deployment can verify |
GET /scan/token/{chain}/{token} | Scan a token before you buy it |
GET /trust/receipts/{chain}/{token}/page | The Receipts page, as HTML anyone can be linked to |
GET /hook-catalog | The hooks a user can select |
POST /hook-catalog | Draft a hook deployment to sign |
POST /brand/preview | Preview a brand from a one-line idea |
GET /showcase | The public showcase listing |
GET /showcase/{slug} | One published showcase entry |
GET /showcase/{slug}/page | That entry as a public page |
GET /showcase/{slug}/badge.svg | The "Molded with putty" badge |
GET /growth/leaderboard | The Receipts leaderboard |
GET /growth/referral | The referral-on-rails loop's status |
Three of them are also reachable as a website page rather than an API call, and
those are linked from /tools: Scan,
Receipts and
Brand preview. The fourth,
Verify, is the same idea. /leaderboard and
/showcase are public pages of their own.
What the free layer is not
It is not free to build on. A free layer that is also the whole product would have nothing to sell. Every operation that creates something a caller keeps — a project, a launch, a contract, a post, a paid key — is behind a bearer and, where it spends work, behind a credit charge.
Three properties are deliberate and worth knowing before you build on it:
- The brand preview persists nothing and reads nothing. It accepts no project, takes no kit id, stores no result and writes no ledger entry, so there is no other user's data reachable from it.
- A preview is not a kit.
POST /brand/previewand the owner-scopedGET/POST /brand/kitsroutes are separate sub-apps on purpose, so the public/private split is visible in the mount rather than in the order of statements inside one file. - Nothing here touches the credit ledger. A free call cannot drain a balance, because there is no balance to read.
The one caveat worth stating
GET /trust/receipts/{chain}/{token} — the JSON Receipts document — is
reachable without a bearer, and that is what a client should expect, but the
OpenAPI document does not declare it security: []. Only the /page HTML
rendering beside it carries the marker. A code generator driven by the document
will therefore treat the JSON route as authenticated and attach a bearer it does
not need; the request still succeeds.
That is a documentation defect in apps/api/openapi.json, not a behaviour
change, and it is recorded here rather than papered over. Everything else in this
list is declared as it behaves.
Why a route carries security: [] at all
The convention in AGENTS.md is that every route is part of the published
contract, so the document is how a client learns what exists. A free operation
that the document does not mark free is a client that asks for a key it does not
have and a support question that never had to exist. The marker is what makes
the free layer discoverable, which is most of why it exists.