Console applications and private APIs

TrustMint has seven tenant remotes and two platform-admin remotes. They run inside the shared FlexGalaxy.AI shells; a remote does not mount its own global header or create a second login session.

Route map

Audience

App

Browser route

Primary jobs

Tenant

ThingMake

/thingmake/

Things, models, registrars, factory integrations, provisioning runs

Tenant

ThingHub

/thinghub/

Repositories, scopes, access grants

Tenant

ThingFeed

/thingfeed/

Adapters, normalized streams

Tenant

ThingIO

/thingio/

Telemetry, twins, attributes

Tenant

ThingLogic

/thinglogic/

Pipelines, rules (threshold + deadman), alarms

Tenant

ThingBand

/thingband/

Data sinks

Tenant

ThingLab

/thinglab/

Templates, profiles, fleets, runs

Platform admin

Arsenal

/arsenal/

Certificate authorities, certificates, governance audit

Platform admin

DeckLoad

/deckload/

Cross-account grants and governance audit

Tenant routes are hosted by console.flexgalaxy.ai; platform-admin routes are hosted by admin-console.flexgalaxy.ai. The route path is the stable application boundary. Nested routes belong to the remote and must stay under that boundary.

ThingMint is an owner service, not a browser application. Certificate operations are exposed to tenants through the workflow that owns them and to platform administrators through Arsenal.

Two API surfaces

TrustMint deliberately separates browser APIs from external APIs.

Private browser API

Each remote calls a same-origin path such as /thingmake/api/, /thingio/api/, or /platform/deckload/. The console gateway validates the shell token, selected account or platform-admin context, and registered route contract before forwarding to the owner service.

These paths are implementation contracts between the shell remote and backend. They may use console-specific response projections and are not supported for external clients.

External API

Partner systems, factory software, and device integrations use documented APIs at api.flexgalaxy.ai or the DDI endpoints. External authentication, versioning, idempotency, error catalogs, and compatibility guarantees apply only to that published surface.

Important

Do not expose a private browser prefix through the public API edge, and do not make a browser remote call an external capability route directly. A capability may share an owner service, but its two ingress contracts remain separate.

Frontend contract rules

  • The shared shell owns authentication, account selection, top-bar navigation, locale, theme, profile, and notifications.

  • The remote owns only its application tabs, resource routes, forms, and local state.

  • Browser calls use the shell’s scoped fetch helper so account and token context cannot drift.

  • Every visible mutation maps to an owner-service operation and handles empty, loading, forbidden, validation, conflict, and server-error states.

  • English, Simplified Chinese, and Japanese labels are part of the release contract; route identifiers and API fields are never translated.