Tiles

Included in the map session. The CDN may answer cached basemap tiles before the token is checked. The tile edge checks the token, then serves the PMTiles basemap through Martin with Cache-Control: public, max-age=3600. When the edge's revocation list is more than 60 s old (database unreachable), basemap tiles are still served — signature, kid, audience, expiry and scope are checked, and revocations loaded before the outage still apply — while overlay, reports and traffic tiles answer 503 auth_unavailable.

Licensed open data, served like the basemap: the same token scope (basemap), the same tile edge and Martin path, Cache-Control: public, max-age=3600, and served while the revocation list is stale. Included in the map session; not metered.

Vector layer canopy, z11–15 (renderers overzoom z15): polygons where the canopy-height model of the High Resolution Canopy Height Maps by Meta and the World Resources Institute (v1, 1 m, imagery © Maxar) gives at least h metres, h ∈ {2, 5, 10, 20}. The classes are nested (a polygon of h = 10 lies inside one of h = 5), so styles stack them or extrude each from the class below. No other attributes. Covers the city areas of Almaty and Astana only; elsewhere tiles are empty (204). Attribution "Tree canopy © Meta & WRI (CC BY 4.0), imagery © Maxar" must be shown while the layer is visible (the style's source carries it). Built by data/scripts/build-canopy.sh.

Token is verified before any cache lookup: the tile edge checks signature, kid, audience, expiry, scp ∋ overlay and the revocation list (key revoked or its policy version changed), then asks Martin, which keeps no cache for this source. Sent with Cache-Control: no-store. Invalidated by the outbox tiles consumer after approval / revert; P95 ≤ 2 s to visible. Clients also bump the source version on overlay.invalidate stream messages. 503 auth_unavailable when the edge's revocation list is more than 60 s old.

same visibility rule as the stream. Every feature carries id, ver, type, verified, heading and exp (epoch seconds); clients hide features past exp locally even if the tile is stale. Same token check and caching as getOverlayTile (scope overlay, Cache-Control: no-store).

Signed-distance-field glyphs for 256 code points of one font stack, as MapLibre requests them from the style's glyphs template. Only the stacks used by Atasu styles exist (Inter Regular,Noto Sans Regular,Noto Sans Arabic Regular, and the Medium, Bold and Italic stacks); any other stack or range is 404. Public: no token is needed and a t query parameter or X-Atasu-Token header is ignored, so the response is the same for every caller. Free and not metered.

Sent with Cache-Control: public, max-age=86400, stale-while-revalidate=604800, a strong ETag (304 on If-None-Match) and Access-Control-Allow-Origin: *. The fonts are Inter and Noto Sans (SIL Open Font License 1.1).

The icon sprite of a style: MapLibre appends .json / .png (and @2x on high-density screens) to the style's sprite URL (.../v1/sprites/standard). Unknown sprites are 404. Public: no token is needed and a t query parameter or X-Atasu-Token header is ignored. Free and not metered.

Sent with Cache-Control: public, max-age=86400, stale-while-revalidate=604800, a strong ETag (304 on If-None-Match) and Access-Control-Allow-Origin: *.

The same style as getStyle, built for MapLibre Native, which cannot evaluate the web style's root state: one document per theme (standard-day.json, standard-night.json), labels in Kazakh. Native SDKs load it, then switch language and theme without a reload by applying getNativeStylePatch documents. Tile, glyph and sprite URLs inside point at this host and carry no token: native SDKs add X-Atasu-Token to tile requests. Unknown files are 404 (standard-3d and navigation until they are built).

Public: no token is needed and a t query parameter or X-Atasu-Token header is ignored, so the response is the same for every caller. Free and not metered; map sessions are counted by createMapSession. Sent with Cache-Control: public, max-age=3600, stale-while-revalidate=86400, a strong ETag (304 on If-None-Match) and Access-Control-Allow-Origin: *. The URL carries no version: a style change reaches apps within an hour, without an app release.

Per layer, the paint and layout values that turn a getNativeStyle document into the given theme (standard-theme-day.json, standard-theme-night.json) or label language (standard-lang-kk.json, -ru, -en); null resets a property to its default. Applying the theme and the language patch, in either order, gives exactly the static style of that theme and language. Layers the loaded style does not have are skipped. Unknown files are 404.

Public and free like getNativeStyle, with the same caching headers. A style and its patches change in the same deploy; an app that holds a style cached for up to an hour may apply a newer patch to it, which at worst shows a newer colour or label rule early.

A style's traffic source points here ("url": ".../v1/traffic/tiles.json") or copies these fields, so MapLibre shows © TomTom in the attribution control whenever the traffic layer is on. Zoom range and bounds are the proxy's coverage (geofence); tiles outside it are never fetched upstream. No token, no data: free and not metered.

Fixed order: verify token (signature, aud, scp contains traffic, revocation, key restrictions) and the organization's traffic entitlement → coverage (z10–14, Kazakhstan bounds) → cache → one upstream fetch per tile across instances (Valkey lock, others wait up to 2 s) → atomic reservation of the organization / product / vendor-account budgets together with the vendor-call ledger row → TomTom → settle. Authorization always comes before the cache: a token without traffic never gets a tile, not even a cached one.

Freshness: cached for min(60 s, contract limit, the vendor's own validity); no-store, no-cache, private or no freshness information from the vendor → not cached. Cache-Control is the remaining validity, always private (the CDN never caches traffic) or no-store. Stale data is never returned unless the contract allows it, and then only within the allowed age with X-Cache: STALE; otherwise 204 with X-Traffic-Status and the SDK shows "traffic temporarily unavailable". A budget that is exhausted degrades the same way (204, budget_exhausted); a budget service that cannot be reached refuses (503 budget_unavailable), never calls upstream. Requests to TomTom carry no user, key or organization identifier. TomTom attribution must be shown while this layer is on (getTrafficTileJson).