API
Galleria’s public reads are unauthenticated and hostname-scoped; everything that mutates sits behind authentication.
| Method | Path | What |
|---|---|---|
| GET | /g/:slug | Public gallery — the JSON feed behind a gallery page. Unauthenticated, hostname-scoped. |
| GET | /g/:slug/:image | Public rendition of a single image in a gallery. |
| GET | /health | Service health. |
| POST | /v1/galleria/… | Authenticated surface (galleries, images, renditions). Requires a forge-auth session cookie (members) or a service credential (hosts). |