Request ids, CORS and the control plane
Request ids
Every response carries X-Request-Id. When the request has one (for example set by
the gateway), it is kept and echoed back; otherwise a UUID is generated. The id is
also visible to the route (in /echo headers), stored with the
inspector entry, logged with the request, and used by the mock LLM
as X-Rustybin-Request-Id (the key of /ai/requests/{id}).
GET {{base_url}}/echo
X-Request-Id: demo-trace-0001
HTTP 200
[Asserts]
header "X-Request-Id" == "demo-trace-0001"
jsonpath "$.headers['x-request-id'][0]" == "demo-trace-0001"
GET {{base_url}}/uuid
HTTP 200
[Asserts]
header "X-Request-Id" matches /^[0-9a-f-]{36}$/
Unknown routes
Unknown paths get a JSON 404 that names the method and path, with a hint:
GET {{base_url}}/no/such/route
HTTP 404
[Asserts]
jsonpath "$.error" == "not found"
jsonpath "$.path" == "/no/such/route"
jsonpath "$.hint" contains "openapi.json"
CORS
By default Rustybin answers CORS for any origin (RUSTYBIN_CORS_ORIGINS=*), so
browser demos and the web console work without a gateway. A preflight (an
OPTIONS request with Access-Control-Request-Method) is answered directly,
mirroring the requested method and headers, with Access-Control-Max-Age: 600. A
plain OPTIONS request without that header reaches the route. Responses expose
X-Request-Id, X-Rustybin-Fault, Content-Length, Mcp-Session-Id,
MCP-Protocol-Version and WWW-Authenticate to browser code.
OPTIONS {{base_url}}/echo
Origin: https://app.example.com
Access-Control-Request-Method: PUT
Access-Control-Request-Headers: x-custom
HTTP 200
[Asserts]
header "Access-Control-Allow-Origin" == "*"
header "Access-Control-Allow-Methods" == "PUT"
header "Access-Control-Allow-Headers" == "x-custom"
header "Access-Control-Max-Age" == "600"
To demonstrate a gateway's own CORS plugin, turn Rustybin's off with
RUSTYBIN_CORS_ORIGINS=off, or restrict it with a comma-separated origin list.
Control plane
Routes under /_rustybin/ describe and manage the instance. They are never
captured by the inspector and ignore the fault injection headers. They are open by
default; RUSTYBIN_CONTROL_AUTH=token or jwt protects them (see
Control-plane security).
| Route | Purpose |
|---|---|
GET /_rustybin/config | Effective configuration, without secrets |
GET /_rustybin/version | Name, version, commit (git_sha), MSRV, build profile and the control auth mode |
GET /_rustybin/ready | Readiness probe: always 200 while serving, independent of /health; never authenticated, limited or captured |
GET /_rustybin/metrics | Prometheus metrics (see Control-plane security, metrics and operations) |
GET, DELETE /_rustybin/requests, GET /_rustybin/requests/{id}, GET /_rustybin/requests/stream | The request inspector |
GET /_rustybin/catalog | The route catalogue as JSON (the web console's API explorer) |
GET /_rustybin/status | Uptime, health, public mode, inspector counters and ports (the console's overview) |
GET /_rustybin/usage | The active plan, its limits, the current usage and the build (see Plans and limits) |
GET {{base_url}}/_rustybin/config
HTTP 200
[Asserts]
jsonpath "$.instance_id" == "docs-examples"
jsonpath "$.admin_token_configured" == true
jsonpath "$.admin_token" not exists
jsonpath "$.mtls_in_header" == "X-Client-Cert"
jsonpath "$.max_delay_ms" == 30000
jsonpath "$.inspector_capacity" == 500
GET {{base_url}}/_rustybin/version
HTTP 200
[Asserts]
jsonpath "$.name" == "rustybin"
jsonpath "$.version" exists
jsonpath "$.profile" exists
jsonpath "$.control_auth" == "open"
GET {{base_url}}/_rustybin/ready
HTTP 200
[Asserts]
jsonpath "$.status" == "ready"
GET {{base_url}}/_rustybin/metrics
HTTP 200
[Asserts]
header "Content-Type" startsWith "text/plain; version=0.0.4"
body contains "# TYPE rustybin_requests_total counter"
body contains "rustybin_request_duration_seconds_bucket{route=\"/uuid\",le=\"0.001\"}"
body contains "rustybin_request_duration_seconds_bucket{route=\"/uuid\",le=\"60\"}"
body contains "rustybin_protocol_requests_total{protocol=\"http\"}"
body contains "# TYPE rustybin_limit_rejections_total counter"
body not contains "/no/such/route"
Related instance endpoints outside the control plane: GET / (landing page, always
200, use it for platform liveness checks; GET /_rustybin/ready is the readiness
equivalent), /health
(a demo toggle) and /identity.