curl --request GET \
--url https://flows.super.ai/api/auth/public-configimport requests
url = "https://flows.super.ai/api/auth/public-config"
response = requests.get(url)
print(response.text)const options = {method: 'GET'};
fetch('https://flows.super.ai/api/auth/public-config', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://flows.super.ai/api/auth/public-config",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://flows.super.ai/api/auth/public-config"
req, _ := http.NewRequest("GET", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://flows.super.ai/api/auth/public-config")
.asString();require 'uri'
require 'net/http'
url = URI("https://flows.super.ai/api/auth/public-config")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
response = http.request(request)
puts response.read_bodyPublic compliance configuration for the signup and sign-in surfaces
Serve the compliance URLs and flags the pre-auth surfaces need (FLO-2652).
Unauthenticated, unparameterised and side-effect free — modelled on
GET /auth/anon-key rather than on an email-parameterised pre-flight. This is
read by every visitor who lands on the sign-in page, so per-email limiting would
be meaningless and a per-IP limiter would fire on shared egress addresses.
Everything returned is already public: two URLs to published pages, two published effective dates, and one boolean about whether we ask for a date of birth.
The client MUST read its compliance links from here rather than hardcoding
them. Hardcoding is what left the signin form pointing at
super.ai/terms_of_service.pdf — a document naming a contracting party we
no longer use — across a change of entity, with nothing to catch it.
curl --request GET \
--url https://flows.super.ai/api/auth/public-configimport requests
url = "https://flows.super.ai/api/auth/public-config"
response = requests.get(url)
print(response.text)const options = {method: 'GET'};
fetch('https://flows.super.ai/api/auth/public-config', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://flows.super.ai/api/auth/public-config",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://flows.super.ai/api/auth/public-config"
req, _ := http.NewRequest("GET", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://flows.super.ai/api/auth/public-config")
.asString();require 'uri'
require 'net/http'
url = URI("https://flows.super.ai/api/auth/public-config")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
response = http.request(request)
puts response.read_bodyResponse
Configuration returned
Unauthenticated, unparameterised compliance configuration for the client.
The frontend reads EVERY compliance URL and flag from here. Nothing is hardcoded in the client: the obsolete PDF link in the signin form is what hardcoding produced last time, and it survived a change of contracting entity.
An empty tos_version is meaningful, not missing: it tells the client the
new documents are not published yet, so it must render its pre-existing
generic assent copy and suppress every anchor link into a document that does
not exist.
Whether the signup flow must collect a date of birth.
Live URL of the Privacy Policy.
Published effective date of the Privacy Policy, or empty.
Live URL of the terms the signup surface links to.
Published effective date of the self-service ToS, or empty. Empty ⇒ the client renders generic assent copy and names no document.
The trader's geographical address for the Art. 246a pre-contractual block. Empty until legal confirms the exact form, in which case the surfaces omit the address line rather than guess.
Contact particulars for the same block.