A keyed lookup with an explicit source-rights boundary.
The universal-card route exposes a mixed structural document for one requested SKU. Legacy source-derived prices, images, and history are withheld. This guide shows how to preserve that boundary without turning null into zero or keyed lookup into a bulk crawl.
GET the card's universal-mirror representation. The `@content_hash` is the change-detection primitive: same hash = same card facts (no change worth re-rendering); different hash = something changed.
Run this
curl https://cambridgetcg.com/api/v1/universal/card/op-op01-001-ja
Expected response shape
{ "@content_hash": "sha256:...", "@retrieved_at": {...}, "rights": { "aggregate": "NOASSERTION", ... }, "price": null, "image_url": null, ... }What to do with it
Store the content hash only if you need to detect changes in the published structural document. Preserve aggregate NOASSERTION and do not infer a price or image from null.
Honor Cache-Control and fetch a card only for a concrete user request. Do not enumerate SKUs to recreate the paused bulk catalog.
Run this
curl https://cambridgetcg.com/api/v1/universal/card/op-op01-001-ja
What to do with it
If the content hash is unchanged, keep your cached structural view. A changed hash means the published document changed; it does not promise that a source price became available.
The temporal endpoint `/api/at/[YYYY-MM-DD]/card/[sku]` returns a dated structural document. It performs no price-history read and does not expose a backfill series.
Run this
curl https://cambridgetcg.com/api/at/2026-03-15/card/op-op01-001-ja
What to do with it
Use `@as_of` to understand the requested date and `@retrieved_at` for production time. Expect price and image to remain null; do not iterate dates as a substitute for a withheld history export.
Anonymous callers to /api/v1/cards/[sku]/cardrush-history receive 401. Signed-in callers receive HTTP 503 with policy status and an empty observations array. Authentication does not create upstream rights.
A withheld price or image is represented as null. Do not render it as a free card, a zero price, or evidence that the source returned no value.
Hashing, normalizing, or transforming an upstream-derived field does not create permission to publish that field.
Next guide
Etiquette + identification + the contact channel.