Use case · Catalog ops

Catalog ops & inventory visibility

When you ship a design plugin, CMS illustrator, or agency library on the Developer Image API, someone still needs a clear answer to: Is the catalog up? How large is inventory? Are we burning the shared rate budget? This page shows how to build a lightweight ops view from documented v1 endpoints only—primarily GET /stats, GET /health, and response headers—while keeping the API key on your backend.

The problem

Product and support teams feel catalog issues as “search is empty,” “export is stuck,” or “everything is slow,” but the underlying causes differ: subscription state, rate-limit exhaustion, a degraded service, or a real inventory change after an index rebuild. Without a small internal dashboard, engineers open production logs under pressure and may even be tempted to call the API from a browser with a live key.

Inventory blindness

Marketing and ops want total_images, total_tags, and when the index was built—without scraping search pages.

Health vs auth noise

A failed search might be DNS, TLS, or service degradation—or a bad key. GET /health separates “is the service up?” from “is our credential valid?”

Shared 30/min budget

All named keys on the account share 30 authenticated requests per minute. Interactive search plus batch jobs plus export minting can collide unless you watch headers.

No invented monitors

Ops tooling must stick to documented v1 surfaces. Do not assume extra metrics APIs beyond what the catalog and management docs describe.

Goal of this use case: A server-side ops strip (or internal admin page) that periodically reads health and stats, samples rate-limit headers from real traffic, optionally tracks tag totals as a coarse inventory signal, and alerts humans—without embedding EPOCHAL_API_KEY in browsers or third-party status widgets.

Safe architecture

Same rule as every other integration: the application backend holds the API key. Your internal dashboard is just another trusted client of your backend (SSO, VPN, or admin session). The backend calls https://epochalstock.com/api/v1.

  • Poll /health more aggressively if needed—it does not require a Bearer token.
  • Poll /stats on a modest cadence (for example every few minutes) and cache the result so monitoring does not burn the 30 req/min budget.
  • Record rate-limit headers from production catalog traffic you already send; avoid synthetic polling loops that only exist to read headers.
  • Never expose the raw API key or management session cookies to the ops SPA.

Ops dashboard mock

Illustrative HTML-only mock using existing site components. Wire the numbers from your backend cache of GET /stats, last GET /health probe, and recent X-RateLimit-Remaining samples—not from browser-side Epochal calls.

Mock only. Figures above are illustrative. Production values come from your server’s last successful GET /stats and live response headers. Do not hardcode inventory numbers into customer-facing marketing without refreshing them from the API.

GET /stats — catalog inventory

Authenticated catalog endpoint. Returns three documented fields for inventory visibility:

Field Meaning for ops
total_images How many images the catalog currently exposes to the API.
total_tags How many normalized tags exist—useful as a coarse taxonomy health signal.
catalog_built_at When the catalog index was built; watch for unexpected staleness or jumps after rebuilds.
GET https://epochalstock.com/api/v1/stats
Authorization: Bearer $EPOCHAL_API_KEY
Accept: application/json

# Counts toward the shared 30 req/min account budget
# Capture X-RateLimit-* and X-Request-ID on the response
  • Cache stats server-side (for example 1–5 minutes) for dashboard reads so operators refreshing a page do not multiply API traffic.
  • Alert on sustained fetch failures, not on a single blip—combine with /health.
  • Store a short time series in your metrics DB if you want trends; the API returns a point-in-time snapshot, not a history endpoint.

Live docs-site snapshot and field examples: Tags & catalog statistics.

GET /health — service availability

GET /health does not require a Bearer token. Use it to verify DNS, TLS, and service availability before debugging authentication or empty search results. OpenAPI documents HTTP 200 as healthy and 503 as degraded.

GET https://epochalstock.com/api/v1/health
# No Authorization header required

# 200 → healthy
# 503 → degraded / unavailable

When health is 200 but search fails

Look at API key validity, subscription state (402), rate limits (429), or request shape—not raw connectivity.

When health is 503

Back off non-critical jobs, surface a maintenance banner in admin UI, and keep capturing X-Request-ID from any authenticated errors you still receive.

Probe cadence

Health is cheap relative to authenticated catalog calls, but still use sensible intervals (for example 30–60s) from a single monitor—not from every browser tab.

Bootstrap

Getting started also recommends health before first search: Getting started.

Watch rate-limit headers

Authenticated catalog traffic is limited to 30 requests per minute per account. Creating more keys does not multiply the budget. Responses include:

X-RateLimit-Limit: 30
X-RateLimit-Remaining: 24
X-RateLimit-Reset: 1784498400
Header Ops use
X-RateLimit-Limit Expected ceiling (30). Graph as a constant reference line.
X-RateLimit-Remaining Throttle workers when low; show the dashboard meter.
X-RateLimit-Reset Unix time when the window resets—schedule burst work after this.
Retry-After On HTTP 429 / rate_limit_exceeded, wait at least this long before retrying.
X-Request-ID Correlation id for support tickets and structured logs.

Practical pattern: Middleware on your Epochal HTTP client records Remaining and Reset into your metrics system on every catalog call you already make (search, batch, stats, download mint). That yields a live budget graph without inventing a dedicated “rate limit status” API.

Deep dive on 429 handling and error codes: Rate limits & errors.

Account usage totals (management—not catalog)

Label clearly: GET /usage is a management endpoint for daily per-endpoint request/error/download totals. It is not part of the catalog surface used with a Bearer API key for search and downloads. It requires the server-side management session (portal cookie + CSRF rules for state-changing sibling calls), not a public browser integration.

If your ops team needs billing-period request breakdowns beyond the live rate-limit headers, your backend can proxy management usage as documented on Security & billing · Account & billing API. Do not confuse /usage with /stats:

Endpoint Auth Answers
GET /stats Bearer API key Catalog inventory snapshot (total_images, total_tags, catalog_built_at).
GET /health None Service health (200 / 503).
GET /usage Management session Daily per-endpoint request/error/download totals (account management).

Code examples

Backend-only probes: health (no key), stats (Bearer key), and recording rate-limit headers. Base URL: https://epochalstock.com/api/v1.

cURL
API_BASE="${EPOCHAL_API_BASE:-https://epochalstock.com/api/v1}"

# 1) Health — no API key
curl -sS -i "$API_BASE/health"

# 2) Stats — Bearer required; note rate-limit headers
curl -sS -D - "$API_BASE/stats" \
  -H "Authorization: Bearer $EPOCHAL_API_KEY" \
  -H "Accept: application/json" \
  -o stats.json

# Inspect X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-Request-ID
# Parse stats.json → data.total_images, data.total_tags, data.catalog_built_at

Additional stats/tags samples: Tags & stats examples. Full multi-language catalog: Code examples.

Ops runbook (short)

Triage order when something feels wrong

  1. HealthGET /health. If 503, assume platform degradation; pause non-essential batch/export load.
  2. Auth & plan — If health is 200 but catalog returns 401/402, fix keys or subscription (see Security & billing).
  3. Budget — Inspect X-RateLimit-Remaining and any 429s with Retry-After. Slow workers; prefer batch metadata over chatty single-id loops.
  4. InventoryGET /stats. Confirm total_images / catalog_built_at still look plausible versus yesterday’s cached snapshot.
  5. Export path — Stuck downloads are often 409 download_already_active or token expiry, not empty inventory. See Safe original export.
  6. Support pack — Collect timestamps, HTTP status, error.code, and X-Request-ID—never API keys or full signed download URLs.

Do

Cache stats, watch headers on real traffic, keep keys server-side, alert on sustained failure.

Don’t

Poll stats every second, embed keys in statuspage widgets, or invent undocumented monitoring endpoints.

Budget awareness

Ops probes share the same 30 req/min pool as product traffic—design them to be quiet.

Downloads note

Binary original GET does not consume an extra catalog request but holds the one-at-a-time lease.

Next steps