Overnight control plane — verification console (portal-backend skeleton)

Every widget below hits a real endpoint on this same origin and shows the raw status + body, so what you see is exactly what the API returned.

Health — GET /actuator/health

(not called yet)

App catalog — GET /api/catalog

Four seeded rows; version/owner/visibility are null until the intake pipeline exists. Click an app id for the single-entry endpoint.

(click an app id, or probe the 404)

Tenant context — GET /api/tenant-context

The portal only consumes X-Tenant-Id / X-Tenant-Role — in production the forward-auth edge stamps them; the inputs here just simulate that edge so you can see both sides of the seam.

(not called yet)

API contract