Any HTTPS origin. No permission from the origin.

Adding a source

A source definition is a small JSON document. It names the origin, the endpoint the client should request, how to locate the field in the response, and which predicates the field supports. Definitions are versioned and pinned to a circuit.

{
  "origin":    "instagram.com",
  "endpoint":  "/api/v1/users/self",
  "method":    "GET",
  "field":     { "path": "$.user.follower_count", "type": "int" },
  "predicates": ["gte", "lte"],
  "circuit":   "tls-predicate-v2",
  "max_bytes": 65536,
  "version":   3
}

Review process

1. Open a pull request against the sources repository with the definition and a redacted sample response.
2. Automated checks confirm the endpoint is reachable over TLS 1.3, the path resolves against the sample, and the response fits the byte cap.
3. Two maintainers review for correctness and for disclosure risk. Fields that could act as unique identifiers are rejected unless hashed.
4. On merge, the definition is pinned and published to the registry contract. Clients fetch definitions by content hash.

Pinning and drift

Origins change their APIs without notice. When a definition stops resolving, the client reports a resolution failure and the source is marked degraded in the registry. Existing credentials remain valid, since they reference the definition version that produced them. A new version is proposed, reviewed, and pinned; verifiers may choose to accept only the latest version.