Fleet Developer Guide

How to call any node

Every node exposes actions at POST/GET https://{node}.graylightcreative.com/v1/{node}/{action} (also reachable via https://graylightcreative.com/v1/{node}/{action}). Every node has a public ping action for a health check with no auth. Everything else needs a signed request:

# 1. Get a tenant api_key + secret_key -- there's no self-serve signup yet, ask ops for one.
# 2. Sign every non-public call: HMAC-SHA256 over (raw request body + timestamp), using your secret_key.
#    timestamp must be within 60 seconds of server time.

$timestamp  = time();
$body       = json_encode(['some' => 'payload']);   // empty string for GET
$signature  = hash_hmac('sha256', $body . $timestamp, $secretKey);

// headers on every request:
X-GL-API-KEY:    <your api_key>
X-GL-TIMESTAMP:  <timestamp>
X-GL-SIGNATURE:  <signature>

This is SovereignIntegrity::enforceIntegrity() — every fleet node uses this same trait for auth, so once you can call one node, you can call all of them. Node dispatch itself lives in FleetNodeController::execute(); routes are wired per-domain in Router.php.