> HISTORICAL DRAFT — This file predates the agent-only mint and fully on-chain art requirements. The NFT contract is not deployed, and owner controls remain undecided. Refer to the website status, not this file, for current launch status.

# API and indexing

`POST /api/rpc` forwards an allowlist of JSON-RPC methods to the configured BSC endpoint; origin check, request size/batch limits and an in-memory rate bucket apply. Limits are per instance and require production edge controls. `/api/health` is an informational health endpoint. The RPC provider learns request metadata; don't put a private RPC credential into a public environment variable.

Optional `npm run index` reads `CHAIN_ID`, `CONTRACT_ADDRESS`, `START_BLOCK`, `RPC_URL`, `PORT`, `CONFIRMATIONS`, `LOG_RANGE`, `POLL_MS`. It persists `services/indexer/data/state.json`, processes confirmed Transfer, HatchRequested and EggHatched logs, checkpoints block hashes and rescans on a detected reorg. Endpoints: `GET /health`, `/owners/<address>`, `/api/eggs/owner/<address>` (frontend), `/eggs/<id>`, `/eggs`. Read-only CORS is enabled. The frontend verifies ownership on-chain; an index can nevertheless be stale or incomplete. Deploy the indexer with persistent storage and external abuse controls. Live integration is not yet verified.