Publish a saved aggregate on a static page

A static page you host can read one deliberately shared saved aggregate. The page needs no backend, token-mint endpoint, refresh service or agent session. Your agent builds the HTML and JavaScript; you deploy and operate it.

Decide what becomes public

Anyone holding the publishable credential can read the approved aggregate. The page exposes that credential in its assets or network traffic. A visitor can copy it and use a nonbrowser client that forges an allowed Origin. Exact origins restrict browser response access; they do not identify visitors or protect against that copied credential. Do not use this recipe for private visitor-only information. Use the backend token recipe when your server must authorize visitors before delivering a short-lived token.

This is sharing outside your organization. In Privacy, explicitly allow aggregate sharing to app views; ordinary read permission never supplies that consent. Your retention and disposal policy covers page downloads, screenshots, logs and other external copies. Revocation and erasure stop future reads from Anectico; they cannot reclaim data someone already displayed or downloaded.

Review one immutable grant

Only a ready saved trend without a breakdown is eligible. Choose exactly one result with its recorded snapshot and content digest, one parent management key, one to three closed projection selectors and one to five exact page origins. The selectors and mandatory coverage envelope are described in the browser recipe. The page receives series IDs, selected measurements, population counts, windows, coverage and limits. It receives no definitions, event names, filters, captured property names, profiles, person or participant identifiers, logs, transcripts, replay, SQL, execution, writes or streams. No anonymous proof link is created.

Set publishable_result_id to the one resource's result ID. That explicit choice is shown in the confirmation preview and cannot be added later to another grant. Set a fixed expiry between five minutes and 30 days, no later than parent expiry. A changed result, projection, origin or expiry needs a reviewed new grant. The parent remains secret and retains ordinary project read authority; only the publishable credential is confined to this one projection.

An owner or admin session or explicitly delegated management builder needs app_views:share, api_key:read, api_key:write, analytics:read, persons:read and every result source permission. MCP writes also need mcp:write; listing needs mcp:read. The exact project parent needs app_views:mint plus the complete base and source ceiling. OAuth is for discovery and does not authorize sharing. No extra scope or general app-key purpose is introduced.

Use app-view grant create and its complete server preview, then repeat every fixed argument, creation key and the server confirmation token. A grant JSON file contains the same immutable fields as the browser recipe, plus "publishable_result_id": "RESULT_UUID"; its resources has only that one result.

anectico --project PROJECT_UUID app-view grant create --file public-grant.json --idempotency-key public-board-1
anectico --project PROJECT_UUID app-view grant create --file public-grant.json --idempotency-key public-board-1 --confirm-token SERVER_TOKEN --out /private/share-material

When using repeated field flags, --publishable-result RESULT_UUID makes the same explicit choice. --out is required on publication apply: a new private file in an existing directory other users cannot write. The CLI writes the credential there and prints only metadata. Through MCP or REST, only the first committed response text contains the one-time credential. Receipts, list responses and identical retries contain metadata only. An uncertain or lost response uses the same creation key to find the original grant; revoke it before reviewing a new intent. There is no secret recovery, rotation or renewal.

Deploy and read directly

Deliberately copy only the approved avp_ credential into your deployed static configuration. Keep source templates with a placeholder. Never put a parent API key, OAuth bearer or Anectico cookie in assets, requests, logs or browser storage. A publishable credential is its own audience, app_publishable; it authenticates no ordinary REST, MCP, CLI, Live, management, mint or exchange operation and cannot obtain any other credential.

const response = await fetch(
  `${apiURL}/api/v1/published-app-views/${grantID}/results/${resultID}`,
  {
    method: 'GET',
    credentials: 'omit',
    cache: 'no-store',
    headers: {
      Authorization: 'AppPublishable PUBLISHABLE_CREDENTIAL',
      Accept: 'application/json',
    },
  },
);

Use HTTPS with the exact approved page origin, including a nondefault port. Loopback HTTP is available only in a development deployment. The browser handles preflight: only GET and the authorization, accept and if-none-match headers are permitted. No wildcard origin, null, cookies or credentialed CORS. The read has no body, query selectors or credential in its URL. Render values as text, use a strict content security policy, and display measurement windows and coverage.

The 200 body is the closed saved aggregate; large counts and grant versions are decimal strings. A matching ETag can return 304 only after current authorization and source and privacy checks. Refresh never executes or remeasures. Appending source data leaves the approved result unchanged or currently withheld or refused. To show a changed measurement, separately authorize a new execution, review a new grant, redeploy that credential and result, and revoke the old grant.

Unknown states, limits and stopping

An unmeasured value, unavailable coverage, expired history or withheld content must remain distinct from a measured zero. Clear the displayed value on an ended or unavailable read; do not reuse the preceding number as a current answer. A revoked grant may make the browser conceal the refusal as a CORS or network error.

Result	What the page does
200	Render the approved measurement and its coverage and expiry envelope.
304	Keep the same currently permitted representation.
400	Fix an invalid body, selector or mixed credential; no aggregate was read.
401	Access ended: stop using the credential and clear the value.
403	Origin, resource, projection or output bound refused; show unavailable.
429	Wait for Retry-After with bounded backoff; never treat refusal as zero.
501 or 502	Protocol unavailable or invalid; stop and report the problem.
503	Verification unavailable; honor Retry-After: 5 and retry within a bound.

The output ceiling is 1 MiB; overflow refuses. Poll no more than once every ten seconds unless the declared contract for your deployment says otherwise. A grant allows two reads per second, burst 20, within its parent's and workspace's shared request allowances. More grants cannot multiply workspace capacity. Flood protection also covers preflight. Unavailable counters expose unchecked headers, not zero or a known remaining allowance. Traffic accounting identifies the grant and parent credential, never a verified page visitor.

In Agents, review the public audience, parent, result and projection, exact origins, expiry and nullable last use, then review and confirm Revoke grant. Revoking its parent key stops every descendant. A freeze can leave reads working and is not the stop action. Expiry, parent permission loss, sharing-policy changes, project deletion and current source erasure or invalidation also stop new reads, including conditional requests. Data already copied remains outside this stop. There is no platform renewer; a later publication is your explicit decision and your redeployment. Local browser proof does not qualify remote hosting or TLS.