Retrieve experiment settings
The programme-wide holdback: the share of visitors held out of EVERY experiment, in basis points of 10000. It is the control the aggregate lift of the whole optimization effort is measured against, and a client reading a per-experiment result should know it exists, since the held-out slice is in no arm’s exposures. A store that has never written the row answers 200 with holdback_bps 0 and updated_at null rather than 404. “Nobody is held out” is a real state of the programme and is what the engine itself does with a missing row.
Authorizations
A secret API key. Publishable keys cannot reach this API. A key may carry an expiry, and an expired key is refused exactly like an unknown one, with a 401 that names no reason; check the key's expires_at in the dashboard rather than inferring it from a response. When a merchant rolls a key's secret they choose a grace window of up to 3 days, and for its duration BOTH the new secret and the one it replaced authenticate, so an integration moves over on its own deploy schedule instead of at the instant the button is pressed. Move before the window closes: after it, the old secret is refused. Nothing else about this contract moves with a roll. The key keeps its id and its scopes, so the only thing an integration updates is the credential itself.
Response
Success
