GET /api/sites/{domain}/manifest

Public, unauthenticated, CORS-open. The machine-readable privacy policy.

Domain, not id

This route is keyed by hostname so anyone can fetch it without knowing the internal UUID. Full shape: Collection manifest.