REST quickstart

Available

Talk to CtrlApp from any language with three requests: register, session, and a read.

Time: ~5 minutes

Prerequisites

A publishable key from Apps → API keys.

Three requests cover the core: identify a device, get the kill-switch decision, and read state. Everything else is a variation on these.

POSThttps://ctrlapp.krdcode.com/api/public/sdk/v1/register

Auth: Authorization: Bearer <PUBLISHABLE_KEY>

Upsert a device.

bash

curl -X POST https://ctrlapp.krdcode.com/api/public/sdk/v1/register \
  -H "Authorization: Bearer <PUBLISHABLE_KEY>" \
  -H "Content-Type: application/json" \
  -d '{ "device_uid": "<DEVICE_ID>", "platform": "web", "app_version": "0.1.0" }'

Expected result

200 OK. The device is now registered against your app.

Get the kill-switch decision

POSThttps://ctrlapp.krdcode.com/api/public/sdk/v1/session

Auth: Authorization: Bearer <PUBLISHABLE_KEY>

Called on every app launch. Returns the current block/force-update decision, if any.

bash

curl -X POST https://ctrlapp.krdcode.com/api/public/sdk/v1/session \
  -H "Authorization: Bearer <PUBLISHABLE_KEY>" \
  -H "Content-Type: application/json" \
  -d '{ "device_uid": "<DEVICE_ID>", "platform": "web", "app_version": "0.1.0" }'

Expected result

A JSON body with the device's session and a block object. Cache the whole response — a client that goes offline must still respect a block.

Read state

GET /controls — server-resolved UI values.
GET /flags/ruleset — ruleset the client evaluates.

Common mistakes

If you get 401 — fix the header — it must be Authorization: Bearer <key>.
If you get 403 — the key belongs to a different app or environment.
If you get 429 — respect the Retry-After header and back off — see rate limits.

Production checklist

Web / JS