---
title: "Resolve the current mablnet worker manifest for the calling Host's channel"
method: GET
path: "/link/mablnet/manifest"
tags: ["LinkMablnet"]
---

# Resolve the current mablnet worker manifest for the calling Host's channel

`GET /link/mablnet/manifest`

Returns the signed release manifest the calling Host should run, after applying the channel's staged-rollout decision for this Host. The manifest body is an opaque, Ed25519-signed document (see `manifest-format.md in link/mablnet/docs`); the api stores and returns it without altering field *values*, so the consumer's JCS re-canonicalisation still verifies — see `link/mablnet/docs/deployment/release-pipeline-api.md` § Opaque signed documents. Rollout resolution (which version this Host receives) is computed server-side from the per-channel rollout state plus a stable per-Host bucket — see § Manifest resolution.
Conditional refetch: callers send their last-known ETag as `If-None-Match`; the server returns `304 Not Modified` (no body) when the resolved manifest is unchanged. The current ETag is mirrored in both the `ETag` header and the mabl-specific `x-mabl-entity-version` header.

## Query parameters

- `channel` string, required
- `host_id` string
- `workspace_id` string
- `label` string

## Headers

- `If-None-Match` string

## Response `200`

Resolved manifest in body; current ETag in headers.

- MablnetManifestEnvelope — Transport envelope carrying a signed mablnet worker release manifest as opaque bytes. The `manifest` field is the **exact** signed manifest document (structure: `manifest-format.md in link/mablnet/docs` § Schema), base64-encoded so it survives the api's JSON layer byte-for-byte — the api never deserialises or reformats the manifest, which is what keeps its Ed25519/JCS signature verifiable on the consumer. The mabl-API transport wraps the manifest this way; the GCS and update-service transports return the same bytes unwrapped, so an API-channel consumer decodes this field before verifying.
  - `manifest` string, required — Base64 of the exact signed manifest bytes. Decode, then verify + parse per manifest-format.md.
  - `rollout_schedule` MablnetRolloutStage[] — Optional rollout schedule for this publish. Omit for the default gradual staged schedule (prod / `stable`). Pass a single `[{percent: 100, since_ms: 0}]` stage to make the version current fleet-wide immediately — used for the `dev`/latest and per-branch channels, where the (typically single) tracking Host must resolve to the new build at once rather than wait out the gradual ramp. api-only orchestration metadata; rides outside the signed manifest bytes, so it does not affect the manifest's signature.
    - `percent` integer, required — Target rolled-out percentage at this stage (0–100).
    - `since_ms` integer, required — Milliseconds after `published_at` at which this stage becomes active.

## Other responses

- `304` — Resolved manifest unchanged since the supplied If-None-Match. Empty body; ETag headers still present.
- `401` — User not authenticated
- `403` — User not authorized
- `404` — No release is current for the requested channel, or this deployment publishes no mablnet worker distribution at all.
- `default` — Unknown error

---

[API](https://skmtc.net/mabl/apis/mabl-api.md) · [All operations](https://skmtc.net/mabl/apis/mabl-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/mabl/mabl-api/revisions/d0fc0114da66/schema)