Mozilla Remote Settings PROD
Official vendor OpenAPI document · agent-readyDeveloper ToolsMonitoring Observabilitynone19 EndpointsREST
For Agents
Read Mozilla's Remote Settings buckets, collections, and records - the live configuration feed Firefox itself consumes - for monitoring blocklists, search bundles, and policy data.
Use for: I need to mirror the Firefox blocklist into my own monitoring stack, Retrieve the latest changeset for the security-state/onecrl collection, List all collections under the main Remote Settings bucket, Check whether a specific record id has changed since my last sync
Not supported: Does not handle Firefox telemetry, account sync, or write access to Mozilla configuration - use for reading the public Remote Settings feed only.
Mozilla Remote Settings is the public Kinto-based configuration service that ships live policy data to Firefox clients, including blocklists, certificate pinning entries, search engine bundles, and feature flags. The API exposes the production endpoint Firefox itself reads, so developers can subscribe to the same authoritative bucket and collection records that ship to billions of browser sessions. It is fully read-only for the public surface, returning JSON records, attachments, and changeset deltas suitable for monitoring or mirroring Mozilla's published configuration.
Install Jentic One Beta
Connect the Remote Settings PROD to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Remote Settings PROD, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fmozilla.com%2Fkinto" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fmozilla.com%2Fkinto" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Remote Settings PROD API.
List public buckets and the collections they contain via GET /buckets and GET /buckets/{bucket_id}/collections
Pull every record in a collection with GET /buckets/{bucket_id}/collections/{collection_id}/records
Fetch a single record by id from /buckets/{bucket_id}/collections/{collection_id}/records/{id}
Subscribe to incremental changes via the /collections/{collection_id}/changeset endpoint with _expected and _since cursors
Discover the latest collection-level timestamp through GET /buckets/monitor/collections/changes/records
Execute multi-request batches against the API in one round-trip via POST /batch
Probe service liveness, version, and OpenAPI surface using the __heartbeat__, __version__, and __api__ utility endpoints
Use Cases
Patterns agents use Remote Settings PROD API for, with concrete tasks.
★ Mirror Firefox Blocklists for Threat Intelligence
Security teams mirror the OneCRL, intermediate, and addon blocklists that Mozilla publishes to Firefox so they can correlate browser-distrusted certificates and malicious add-ons against their own telemetry. The /buckets/security-state/collections/onecrl/changeset endpoint streams only what has changed since the caller's last cursor, keeping the mirror cheap to maintain.
Call GET /buckets/security-state/collections/onecrl/changeset with _expected set to the latest timestamp from the monitor collection, then ingest each new record into a SIEM.
Track Firefox Search Engine Configuration Drift
Browser product teams and competitive analysts track which default search engines Firefox ships per locale and channel. The main/search-config-v2 collection on Remote Settings is the canonical source. Pulling the records endpoint on a schedule and diffing against the previous snapshot exposes any change Mozilla rolls out before it hits Firefox release populations.
Fetch GET /buckets/main/collections/search-config-v2/records, diff against last week's snapshot, and report any locale where the default engine changed.
Validate That Remote Settings Is Healthy Before a Release
Release engineering pipelines verify that the Remote Settings service is reachable and serving fresh data before promoting a Firefox build. The /__heartbeat__ and /__version__ endpoints return service health and build identity, while /buckets/monitor/collections/changes/records exposes the most recent collection update timestamps. A red signal blocks the release pipeline.
Call GET /__heartbeat__, then GET /buckets/monitor/collections/changes/records, and fail the pipeline if any collection has not updated in 24 hours.
Agent-Curated Mozilla Policy Snapshot
An AI agent assembles a daily snapshot of Mozilla's public policy configuration - blocklists, partner content, search defaults - for editorial or research workflows. Through Jentic the agent searches for 'fetch mozilla remote settings collection', loads the records schema, executes /buckets/{bucket}/collections/{collection}/records for the targets, and returns a normalised report. No credentials are needed since the production surface is public.
Search Jentic for 'fetch mozilla remote settings collection', load the records schema, and pull main and security-state collections into a normalised JSON snapshot.
Key Endpoints
19 endpoints — mozilla remote settings is the public kinto-based configuration service that ships live policy data to firefox clients, including blocklists, certificate pinning entries, search engine bundles, and feature flags.
METHOD
PATH
DESCRIPTION
GET
/buckets
List public buckets
GET
/buckets/{bucket_id}/collections
List collections inside a bucket
GET
/buckets/{bucket_id}/collections/{collection_id}/records
List all records in a collection
GET
/buckets/{bucket_id}/collections/{collection_id}/changeset
Fetch incremental changeset for a collection
GET
/buckets/monitor/collections/changes/records
Discover most recent collection update timestamps
POST
/batch
Run multiple read requests in one round trip
GET
/buckets
List public buckets
GET
/buckets/{bucket_id}/collections
List collections inside a bucket
GET
/buckets/{bucket_id}/collections/{collection_id}/records
List all records in a collection
GET
/buckets/{bucket_id}/collections/{collection_id}/changeset
Fetch incremental changeset for a collection
GET
/buckets/monitor/collections/changes/records
Discover most recent collection update timestamps
POST
/batch
Run multiple read requests in one round trip
Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring Remote Settings by hand means learning the Kinto bucket and collection model and constructing changeset reads against the Firefox settings host. Through Jentic you install once, import Remote Settings PROD from the API Directory, and your agent calls it.
Permission scoping
Remote Settings puts the bucket id in the URL path (/buckets/{bucket_id}/...), so a rule can pin your agent to one bucket: it can read that bucket's collections, records, and changesets and nothing else. You choose the operations it may call, so it stays on the read-only feed.
Credential isolation
Remote Settings read access needs no credentials, so none are stored, and your own Jentic One instance still scopes the agent to the read-only operations so it cannot reach any authoring or admin surface. Nothing sensitive enters the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'fetch a Mozilla Remote Settings collection', and Jentic returns the bucket, collection, and changeset operations with their input schemas, so the agent reads the feed without learning the Kinto record model.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Remote Settings PROD API through Jentic.
What authentication does Remote Settings PROD use?
The public production surface at firefox.settings.services.mozilla.com/v1 is read-only and unauthenticated - the same anonymous endpoint Firefox itself calls. Through Jentic this means the agent can execute reads with no credential setup at all.
Can I subscribe to incremental updates instead of refetching full collections?
Yes. GET /buckets/{bucket_id}/collections/{collection_id}/changeset takes _expected and _since cursors and returns only the records that have changed since the last sync, which is how Firefox itself stays current without redownloading collections.
What are the rate limits for Remote Settings PROD?
Remote Settings is fronted by a CDN and tuned to serve every Firefox client globally, so realistic developer use is rarely throttled, but Mozilla can rate-limit abusive callers. Use the changeset endpoint with cursors and the /batch endpoint to keep request volume low.
How do I monitor a specific collection through Jentic?
Search Jentic for 'fetch mozilla remote settings collection', load the changeset schema, and execute GET /buckets/{bucket_id}/collections/{collection_id}/changeset on a schedule. The agent stores the latest timestamp and passes it as _since on the next call.
Is Remote Settings PROD free?
Yes. Mozilla operates Remote Settings as public infrastructure for Firefox clients and any developer can read the published collections at no cost.
Can I write to Remote Settings via this API?
No. The production endpoint exposes only read operations to the public. Writes happen on Mozilla's internal authoring servers and are reviewed before being signed and published to this read-only surface.
Can I limit what my agent is allowed to do with the Remote Settings API?
Yes. Because you run Jentic One yourself, your own rules decide which Remote Settings operations and buckets the agent may touch. Remote Settings puts the bucket id in the URL path, so you can pin the agent to a single bucket such as main or security-state and let it read only that bucket's collections, records, and changesets. You also choose the exact operations it may call, so it stays on the public read-only feed and cannot reach any authoring or admin surface.
GET STARTED