GCA Access API Contract

Live Cloudflare Workers + D1 email registration intake for the GCA user list. It requires an email and safety acknowledgements only; it does not request a wallet, signature, private key, seed phrase, payment, or exchange API secret.

Token-protected admin read for operator review. Public visitors cannot read the registration ledger.

Live public email do-not-contact request using gca_contact_suppression_v1. It records only an email, reason, source, and safety acknowledgements; no wallet, signature, transaction, private key, seed phrase, payment, or exchange API secret is requested.

Token-protected admin read for local suppression sync. Operators use tools/sync_cloudflare_contact_suppressions.py and the local ops pipeline before contact CSV export.

Live public access configuration for GCA thresholds, chain ID, contract address, ledger boundaries, and safety rules.

Live account intake for gca_member_access_v2. The browser submits a random device status key, while D1 stores only its SHA-256 hash. The route stores account fields, verifies the current Base wallet balance, writes eligible credit records, and queues qualifying GCA Member evidence. A user-submitted date or transaction hash never activates membership automatically.

Live read-only lookup for gca_account_status_v1. A matching unexpired device key returns a redacted account, wallet-verification, credits, member-review, and member-benefit snapshot. The response excludes email, email hash, full wallet address, device key, administrator data, operator notes, IP data, and user-agent data.

Live credential-only rotation for gca_account_status_rotation_v1. The current valid key is replaced by a new browser-generated key; only SHA-256 hashes are stored. The old key cannot read status and can only retry the same completed rotation for 15 minutes. No account, ledger, wallet, or token record changes.

Live public request for gca_account_status_recovery_request_v1. The browser pre-commits a new random device key and the API always returns the same pending response without revealing whether the email and Base wallet match an account.

Live ADMIN_READ_TOKEN-protected review and approval routes. An operator must verify control of the registered mailbox before issuing a 24-hour credential. D1 stores only hashes; the credential is returned once.

Live completion for gca_account_status_recovery_v1. A matching single-use credential activates the pre-committed new key and immediately invalidates the old key. Account, wallet, credits, member records, GCA balances, and on-chain assets are unchanged.

Live account request route for gca_account_service_request_v1. An active device key identifies the account; the server selects the catalog credit unit, applies account-scoped idempotency and a five-request daily limit, then queues manual review without reserving or deducting credits.

Live redacted history for gca_account_service_request_status_v1. It returns the matched account's latest 25 requests, latest public prompt, follow-up time and count, delivery state, credits used, and remaining balance. Email, full wallet, keys, full request and response bodies, reviewer identity, and operator notes are omitted.

Live gca_account_service_request_followup_v1 response for the matching device-key account after a more-information review. Responses are append-only, account-scoped, limited to five per request, and idempotent; submission returns the request to manual review without changing credits, wallets, tokens, or trading permission.

Live gca_account_service_delivery_receipt_v1 confirmation for the matching device-key account after completed delivery. It writes one idempotent receipt marker and does not refund or deduct credits, connect a wallet, request a signature, send a transaction, transfer tokens, or create trading permission.

Live gca_account_service_request_cancellation_v1 cancellation for the matching device-key account. It is permanent, account-scoped, idempotent, and accepted only while the request remains queued with no operator review. It changes no credits, wallet, token, member, or trading-permission state and keeps the audit record.

Live read-only GCA balance checks using Base Mainnet eth_call and ERC-20 balanceOf.

Token-protected admin read for account-level 100 GCA AI Quant Access credits records.

Live token-protected operator queue for requested GCA AI Quant Access service scope before delivery. The latest public and admin read-only smoke checks passed on 2026-08-10 UTC. Anonymous reads return HTTP 401. Queueing does not deduct credits, connect wallets, request signatures, send tokens, or create trading permission.

Live ADMIN_READ_TOKEN-protected append-only review and delivery route for gca_service_request_review_v1. More-information decisions require a public non-sensitive memberPrompt. Delivery requires prior approval and a non-sensitive deliveryReference; retries cannot deduct twice.

Live token-protected operator read for append-only follow-up responses. Authorized operators can read the response for manual review; public account history exposes only the prompt, submission time, and count.

Live token-protected operator ledger for reviewed service-level credit usage. Initial migration and deploy passed on 2026-07-23 UTC; the latest public and admin read-only smoke checks passed on 2026-07-27 UTC. Anonymous reads return HTTP 401. It records service ID, credits used, before/after balance, and status; it never connects wallets, requests signatures, sends tokens, or creates trading permission.

Token-protected admin read for GCA Member ledger state, holding-period review, 10,000 GCA member benefit status, next refresh due date, and status.

Production-live, ADMIN_READ_TOKEN-protected operator route for append-only member review decisions. Approval refreshes the balance at a safe Base block and requires a 1,000,000 GCA balance, supporting 30-day evidence, explicit operator acknowledgements, and a complete observed 30-day transfer-history reconstruction whose minimum balance is at least 1,000,000 GCA. It never signs, sends GCA, or authorizes the 10,000 GCA benefit transfer.

Production-live, ADMIN_READ_TOKEN-protected read for append-only observed holding evidence written during successful member approval. It includes the safe snapshot block, current and minimum balances, event counts, history completeness, reconstruction consistency, and provider. It is not a third-party audit or a future holding guarantee.

Creates or updates support review records for manual review workflows.

Reads review status for the authenticated account after the controlled account UI exists.

Local-only operator path to append a manual support review status update. It writes to the local JSONL ledger only and never sends replies, writes production data, calls wallets, requests signatures, or transfers GCA.

Production-live and ADMIN_READ_TOKEN-protected. After a manual reserve-wallet transfer exists, operators use tools/record_cloudflare_member_benefit_transfer.py to submit its public hash. The route verifies a successful receipt at or below the Base safe block, the official reserve sender, the approved member recipient, the GCA contract, and exactly 10,000 GCA. It records gca_member_benefit_transfer_v1 evidence and never signs or sends tokens.

Local-only console summary for email registration, pre-registration, wallet verification, credit ledger, member ledger, member benefit transfer, and support review counts. The localhost backend writes local JSONL ledger records for testing only.

Local-only redacted daily digest view created by tools/run_gca_daily_ops.py --build-digest. It returns public health, BaseScan preflight status, member ops counts, support queue counts, holding evidence counts, and next actions without user records, emails, admin tokens, signatures, or automatic transfers.

Local-only manual checklist derived from local ledger counts and the redacted operator digest. It ranks next actions and shows a redacted support preview; it never sends replies, writes production data, connects wallets, or transfers GCA.

Local-only reviewer evidence export for support and platform follow-up. It includes local ledger totals, latest records, recordManifest, packageDigestSha256, public reference links, and safety boundaries. Use ?redact=public before external sharing, tools/export_gca_review_package.py to export from local JSONL data without running the server, and tools/verify_gca_review_package.py to verify the digest.