Trust registry API

Method	Path	Auth	Purpose
GET	/trust-registry	Token	The caller's domain-to-tier rules.
PUT	/trust-registry/:domain	Token	Upsert a trust rule. The domain is lowercased.
DELETE	/trust-registry/:domain	Token	Delete a trust rule.

Trust rules are per account and apply to every watch you own. They are layered over Watcher’s built-in registry, and the most specific matching rule wins.

Read your rules

curl -s https://<your-host>/trust-registry -H "authorization: Bearer $TOKEN"

{ "registry": { "example.gov": "official", "rumour-site.test": "low" } }

This returns only your rules, not the built-in ones they layer over.

Add or update a rule

curl -s -X PUT https://<your-host>/trust-registry/example.gov \
  -H "authorization: Bearer $TOKEN" \
  -H 'content-type: application/json' \
  -d '{"tier":"official"}'

Valid tiers: official, trusted, unknown, low. Domains are lowercased, and a rule matches the domain and its subdomains.

Delete a rule

curl -s -X DELETE https://<your-host>/trust-registry/example.gov \
  -H "authorization: Bearer $TOKEN"

{ "deleted": true }

Why this matters more than it looks

An ungraded source cannot raise a confirmed alert — it is capped at the weak “unconfirmed” tier. Adding one official rule for the site you actually care about is often the difference between a stream of unconfirmed alerts and clean confirmed ones. See Source trust.

Choosing a tier

Tier	Use for
official	The authority itself — the issuing body, the project’s own site
trusted	A secondary source you rely on: a reputable outlet that reports quickly
unknown	Explicitly ungraded. Same effect as no rule, but documents the decision
low	A site that keeps generating noise. It can never lift an alert above weak