Get the signed app config

GET

/v1/mobile/workspaces/{workspaceKey}/config

Code sample: curl

# The Grona SDK makes this call. Your code does not.
curl https://api.grona.ai/v1/mobile/workspaces/acme-market/config \
  -H 'Accept: application/jose+json'

• Production

Called by the Grona SDK, not by your code.

The config is public: the workspace key ships inside the app, and the config carries no personal data and no identifiers. The body is a JWS in flattened JSON serialization, signed with ES256, with the protected header exactly {"alg":"ES256","kid":"...","typ":"grona-config+jws"}. The envelope is at most 768 KB and the decoded payload at most 512 KB.

How the SDK handles the response:

• 200: verifies the signature and applies the config.
• 304: keeps its current copy. This does not extend the config’s expires_at.
• 429, 5xx and network errors: backs off with jitter and honours Retry-After, waiting at most one hour.
• Redirects and any other 4xx: keeps the last good config.

Parameters

Path Parameters

workspaceKey

required

string

/^[A-Za-z0-9._:-]{1,128}$/

The public workspace key the app passes to the SDK.

Example

acme-market

Header Parameters

If-None-Match

string

The ETag of the copy the SDK holds. Not sent for the copy bundled with the app.

Responses

200

The signed config.

Media typeapplication/jose+json

JWS in flattened JSON serialization (RFC 7515, section 7.2.2). Base64url without padding.

object

protected

required

Base64url of {"alg":"ES256","kid":"...","typ":"grona-config+jws"}. No other header fields.

string

payload

required

Base64url of the config JSON.

string

signature

required

Base64url of the 64-byte ES256 signature over protected + "." + payload.

string

Example ^generated

{
  "protected": "example",
  "payload": "example",
  "signature": "example"
}

Headers

ETag

string

Entity tag for the next conditional request.

304

Not modified. The SDK keeps its copy, and its expires_at does not move.

429

Too many requests. Retry with exponential backoff and jitter, and wait at least as long as Retry-After when it is present. Branch on the status code; the body is not guaranteed to use the error envelope.

Headers

Retry-After

string

How long to wait before retrying, in seconds or as an HTTP date.

4XX

The SDK keeps its last good config.

5XX

The SDK keeps its last good config and retries with backoff.