Going live

Publish

A catalog change (an entry, a text, an order, a category) is saved at once and shows on your front after you publish. “Publish” in the console calls POST /v1/admin/sites/{siteId}/publish: the API drops its cached catalog of the site, then purges the site’s CDN zone when the site has one. The answer says what was purged.

With a Bunny pull zone on the site row (cdnPullZoneId, set by staff), the purge reaches your pages at once.
Without one, nothing is purged and reason says no_zone: your front picks the change up on its own within the catalog’s revalidation delay, max-age=300, stale-while-revalidate=600. A front behind another CDN purges it itself.
A 503 means the CDN did not accept the purge. Retry in a minute.

Publish

curl -X POST 'https://api.filudi.com/v1/admin/sites/00000000-0000-0000-0000-000000000000/publish' \
  -b "filudi_console=$FILUDI_SESSION" \
  -H 'origin: https://developers.filudi.com'

const response = await fetch(`https://api.filudi.com/v1/admin/sites/${siteId}/publish`, {
  method: 'POST',
  credentials: 'include',
});
const { purged, reason, at } = await response.json();

result = session.post(f'https://api.filudi.com/v1/admin/sites/{site_id}/publish').json()
# {'purged': False, 'reason': 'no_zone', 'at': '2026-10-30T12:00:00Z'}

Game versions need no publish on your side: a version a developer activates is live on every site that lists the game, and the bundle’s HTML is cached 5 minutes at most.

The approval queue

Two things of yours wait for staff, in one queue, oldest first, each with an email to staff when it appears:

The site, after creation.
Each domain you propose.

Listing a game, its texts, your categories and your keys need no approval.

A refusal comes by email with a reason, and the item stays pending so you can change it and ask again. Staff also approves games and versions, which concerns game developers; a game you list goes live on your site when its developer’s version is activated.

Before players arrive

Your domain is approved: GET /v1/admin/sites/{siteId} shows it in domains, no longer in pendingDomains. A page on it gets CORS headers from the API and frames a game.
Your pages send the CSP of CORS and origins and no bundle is served from your origin.
/account/verify (and /<locale>/account/verify for each locale after the first) consume the magic link and send Cache-Control: private, no-store, when accountsAllowed is on.
The page that asks for a sign-in link offers the 6-digit code field.
Consent: pass the visitor’s real consent to the frame, and gate your analytics tag the way your law requires. The CMP of hub-core ships with a placeholder IAB id; register your own before using it.
A catalog with at least one visible game whose developer has a live version. Everything else shows an empty page.
The privacy page says that saves, scores and the email of an account are kept by the Filudi API for your site, and that a player may export and delete their data from the account page (hub-core’s PlayerClient has both calls).

After launch

The console’s statistics show the first sessions within a minute. The feedback form of hub-core (sendFeedback) writes to your site’s feedback list in the console, where you mark messages seen or done. Comments and ratings of your players are moderated from the same console.