Which extension zones and platform capabilities are globally disabled, per-resource API read/write deny lists, the approved CDN origin allowlist, the bundle-analysis thresholds and rule policy (reported RESOLVED — every rule with its effective mode), the current ruleset fingerprint, and csp-coverage (whether the portal's deployed CSP script-src actually covers the approved origins). Open to ANY authenticated caller — every Horizon client needs it to gate its extension apps. An unprovisioned instance answers 200 with defaults, not 404.
Request
Authorization
Bearer Token
Provide your bearer token in the
Authorization
header when making requests to protected resources.
Example:
Authorization: Bearer ********************
or
Responses
🟢200OK
application/json
The settings object. Reseller-and-above receive all ten fields; a lower scope receives only the five client-gating fields (see the schema). Within the set returned, all fields are always present — unset storage falls back to the code default, never null.