What the API sees of the caller’s address
const url = 'https://beta-api.plune.ai/v1/admin/client-ip';const options = {method: 'GET', headers: {cookie: 'plune_session=<plune_session>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url https://beta-api.plune.ai/v1/admin/client-ip \ --cookie plune_session=<plune_session>For the operator to find out what the edge (the reverse proxy) sends: call it through the real edge with a forged X-Forwarded-For and read which entry the API keys its per-IP limits on (docs/RUNBOOK.md §4e). chosen is that entry (null when there is nothing to key on: the limit is then off for the request), hops is TRUSTED_PROXY_HOPS (null = unset, the first entry is read). The header is returned as received and is never logged. Owner-only and session-only, as GET /v1/admin/tiers; everyone else gets 404. Ten calls a minute.
Authorizations
Section titled “Authorizations ”Responses
Section titled “ Responses ”The address as the API sees it
object
The address of the connection the API accepted (the edge, behind a proxy)
The X-Forwarded-For header as received, null when absent
The address the per-IP limits key on
TRUSTED_PROXY_HOPS; null when unset
Example
{ "socketAddress": "172.18.0.4", "xForwardedFor": "1.2.3.4, 203.0.113.7", "chosen": "203.0.113.7", "hops": 1}No / invalid session
The caller does not own the application
object
Example generated
{ "error": "example"}Rate-limited: the per-route throttle, or the per-minute request limit of the plan an API token counts by (#1442; the body names the plan, #2092). Retry-After carries the seconds until the window rolls over.
object
Example generated
{ "error": "example"}Headers
Section titled “Headers ”Seconds until the window rolls over