API only. Nothing is served here yet: the routes are /api/record/timeline and /api/report, and both refuse a request that carries no signed session.