API

This site publishes a small, unauthenticated HTTP surface. It is documented here because the pages themselves use it, and because anyone auditing this site should be able to read what it answers without reverse-engineering the JavaScript.

The machine-readable copy of what follows is /openapi.json (OpenAPI 3.1), and the assistant-facing manifest is /.well-known/ai-plugin.json.

Endpoints

GET /healthz

Liveness probe for the vhost. Answers 200 with the plain-text body ok.

1
2
$ curl -s https://ymrtech.com/healthz
ok

GET /contact/token.json

Returns the token the contact form sends as X-Contact-Token:

1
{ "token": "…" }

It ships with the site and is not a secret — anything in a page’s source is public. Its job is to reject tokenless bots before they can spend a real visitor’s rate-limit budget. The per-IP rate limit, not the token, is what bounds a caller who reads the token.

POST /contact/submit

The contact form. Accepts application/x-www-form-urlencoded or multipart/form-data.

Requires the X-Contact-Token header. Responses:

POST /vpn/rum/collect

The first-party, cookieless telemetry beacon that this site’s own pages POST to: one page_view event per page, web-vitals timings, and uncaught errors. It is same-origin by design and changes with the client, so it is described here to be complete, not offered as an integration point. What it does and does not collect is stated in the privacy policy and enforced by a build gate.

Not a public API

Everything under /api/* belongs to the client portal (/account): it is session-authenticated, it carries device and subscription data, and it changes with the portal. It is deliberately absent from the OpenAPI document. If you need something from it, ask — do not build against it.

Machine-readable site metadata

Every one of those files is generated from this repository and checked by a gate on every build — a metadata file that stops parsing, or an Expires date that came too close, fails CI rather than shipping.