---
title: "Proxies & Raw-Data Passthroughs"
description: "Thin server-side proxies for upstream APIs — used by the dashboard to avoid CORS, hide credentials, and add rate-limiting and edge caching."
---

These endpoints pass caller requests through to an upstream data source. They exist to:

1. Hide upstream API keys server-side
2. Work around CORS
3. Add caching + per-IP rate limiting
4. Normalize response shapes

<Warning>
Most proxies are intended for **our own dashboard** and are lightly gated. They are not part of the public API contract and may change or be removed without notice. Prefer the domain RPC services (`/api/<domain>/v1/*`) for stable integrations.
</Warning>

## Raw-data passthroughs

| Endpoint | Upstream | Purpose |
|----------|----------|---------|
| `GET /api/opensky` | OpenSky Network | Live ADS-B state vectors. Used by the flights layer. |
| `GET /api/polymarket` | Polymarket gamma-api | Active event contracts. |
| `GET /api/gpsjam` | gpsjam.org | GPS interference hotspot reports. |
| `GET /api/oref-alerts` | OREF (Israel Home Front Command) | Tzeva Adom rocket alert mirror. |
| `GET /api/supply-chain/hormuz-tracker` | Internal AIS + registry | Real-time Hormuz transit dashboard data. |

All proxies:
- Respect the origin CORS allowlist.
- Apply per-IP rate limits via `_ip-rate-limit.js` (~ 60 req/min/IP default).
- Cache aggressively (`s-maxage` varies by upstream).

## Content proxies

### `GET /api/rss-proxy?url=<allowed-feed>`

Fetches an RSS/Atom feed and returns the parsed JSON. The URL must match one of the patterns in `_rss-allowed-domains.js` — arbitrary URLs are refused to prevent SSRF.

## Skills registry

### `GET /api/skills/fetch-agentskills`

Returns the catalog of "skills" (agent capabilities) the WorldMonitor chat analyst can invoke. Used internally by `chat-analyst.ts` and the widget agent.

## Legacy / internal

### `POST /api/fwdstart`

Forward-starting scenario helper used by the desktop app during first-run. Internal.

### `GET /api/mcp-proxy`

Legacy MCP shim — forwards to the current MCP route. Deprecated; use [`/api/mcp`](/mcp-overview) directly.
