canonical: https://jentic.com/apis/mozilla.com/kinto # Mozilla Remote Settings PROD Mozilla Remote Settings is the public Kinto-based configuration service that ships live policy data to Firefox clients, including blocklists, certificate pinning entries, search engine bundles, and feature flags. The API exposes the production endpoint Firefox itself reads, so developers can subscribe to the same authoritative bucket and collection records that ship to billions of browser sessions. It is fully read-only for the public surface, returning JSON records, attachments, and changeset deltas suitable for monitoring or mirroring Mozilla's published configuration. ## For AI agents Read Mozilla's Remote Settings buckets, collections, and records - the live configuration feed Firefox itself consumes - for monitoring blocklists, search bundles, and policy data. ## Scope Does not handle Firefox telemetry, account sync, or write access to Mozilla configuration - use for reading the public Remote Settings feed only. ## Capabilities - List public buckets and the collections they contain via GET /buckets and GET `/buckets/{bucket_id}/collections` - Pull every record in a collection with GET `/buckets/{bucket_id}/collections/{collection_id}/records` - Fetch a single record by id from `/buckets/{bucket_id}/collections/{collection_id}/records/{id}` - Subscribe to incremental changes via the `/collections/{collection_id}/changeset` endpoint with _expected and _since cursors - Discover the latest collection-level timestamp through GET `/buckets/monitor/collections/changes/records` - Execute multi-request batches against the API in one round-trip via POST /batch - Probe service liveness, version, and OpenAPI surface using the __heartbeat__, __version__, and __api__ utility endpoints ## Use cases ### Mirror Firefox Blocklists for Threat Intelligence Security teams mirror the OneCRL, intermediate, and addon blocklists that Mozilla publishes to Firefox so they can correlate browser-distrusted certificates and malicious add-ons against their own telemetry. The `/buckets/security-state/collections/onecrl/changeset` endpoint streams only what has changed since the caller's last cursor, keeping the mirror cheap to maintain. Example prompt: Call GET `/buckets/security-state/collections/onecrl/changeset` with _expected set to the latest timestamp from the monitor collection, then ingest each new record into a SIEM. ### Track Firefox Search Engine Configuration Drift Browser product teams and competitive analysts track which default search engines Firefox ships per locale and channel. The main/search-config-v2 collection on Remote Settings is the canonical source. Pulling the records endpoint on a schedule and diffing against the previous snapshot exposes any change Mozilla rolls out before it hits Firefox release populations. Example prompt: Fetch GET `/buckets/main/collections/search-config-v2/records`, diff against last week's snapshot, and report any locale where the default engine changed. ### Validate That Remote Settings Is Healthy Before a Release Release engineering pipelines verify that the Remote Settings service is reachable and serving fresh data before promoting a Firefox build. The /__heartbeat__ and /__version__ endpoints return service health and build identity, while `/buckets/monitor/collections/changes/records` exposes the most recent collection update timestamps. A red signal blocks the release pipeline. Example prompt: Call GET /__heartbeat__, then GET `/buckets/monitor/collections/changes/records`, and fail the pipeline if any collection has not updated in 24 hours. ### Agent-Curated Mozilla Policy Snapshot An AI agent assembles a daily snapshot of Mozilla's public policy configuration - blocklists, partner content, search defaults - for editorial or research workflows. Through Jentic the agent searches for 'fetch mozilla remote settings collection', loads the records schema, executes `/buckets/{bucket}/collections/{collection}/records` for the targets, and returns a normalised report. No credentials are needed since the production surface is public. Example prompt: Search Jentic for 'fetch mozilla remote settings collection', load the records schema, and pull main and security-state collections into a normalised JSON snapshot. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | GET | `/buckets` | List public buckets | | GET | `/buckets/{bucket_id}/collections` | List collections inside a bucket | | GET | `/buckets/{bucket_id}/collections/{collection_id}/records` | List all records in a collection | | GET | `/buckets/{bucket_id}/collections/{collection_id}/changeset` | Fetch incremental changeset for a collection | | GET | `/buckets/monitor/collections/changes/records` | Discover most recent collection update timestamps | | POST | `/batch` | Run multiple read requests in one round trip | ## Key resources - **Buckets** — Top-level namespaces grouping collections - main, security-state, monitor - **Collections** — Named groupings of records inside a bucket - **Records** — Individual configuration entries served to Firefox clients - **Changeset** — Incremental delta endpoint for subscribing to collection updates - **Batch** — Compose multiple read requests into one round trip - **Utilities** — Heartbeat, version, and OpenAPI introspection endpoints ## Why Jentic - **Setup:** Wiring Remote Settings by hand means learning the Kinto bucket and collection model and constructing changeset reads against the Firefox settings host. Through Jentic you install once, import Remote Settings PROD from the API Directory, and your agent calls it. - **Permission scoping:** Remote Settings puts the bucket id in the URL path (`/buckets/{bucket_id}/...`), so a rule can pin your agent to one bucket: it can read that bucket's collections, records, and changesets and nothing else. You choose the operations it may call, so it stays on the read-only feed. - **Credential handling:** Remote Settings read access needs no credentials, so none are stored, and your own Jentic One instance still scopes the agent to the read-only operations so it cannot reach any authoring or admin surface. Nothing sensitive enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'fetch a Mozilla Remote Settings collection', and Jentic returns the bucket, collection, and changeset operations with their input schemas, so the agent reads the feed without learning the Kinto record model. ## Related APIs - **Firebase API** — Firebase delivers configuration and feature flag payloads to mobile and web clients - **Segment API** — Segment can deliver server-side configuration and event routing to client apps - **GitHub REST API** — GitHub hosts the open Mozilla Remote Settings client and publishes related security advisories ## FAQ ### What authentication does Remote Settings PROD use? The public production surface at firefox.settings.services.mozilla.com/v1 is read-only and unauthenticated - the same anonymous endpoint Firefox itself calls. Through Jentic this means the agent can execute reads with no credential setup at all. ### Can I subscribe to incremental updates instead of refetching full collections? Yes. GET `/buckets/{bucket_id}/collections/{collection_id}/changeset` takes _expected and _since cursors and returns only the records that have changed since the last sync, which is how Firefox itself stays current without redownloading collections. ### What are the rate limits for Remote Settings PROD? Remote Settings is fronted by a CDN and tuned to serve every Firefox client globally, so realistic developer use is rarely throttled, but Mozilla can rate-limit abusive callers. Use the changeset endpoint with cursors and the /batch endpoint to keep request volume low. ### How do I monitor a specific collection through Jentic? Search Jentic for 'fetch mozilla remote settings collection', load the changeset schema, and execute GET `/buckets/{bucket_id}/collections/{collection_id}/changeset` on a schedule. The agent stores the latest timestamp and passes it as _since on the next call. ### Is Remote Settings PROD free? Yes. Mozilla operates Remote Settings as public infrastructure for Firefox clients and any developer can read the published collections at no cost. ### Can I write to Remote Settings via this API? No. The production endpoint exposes only read operations to the public. Writes happen on Mozilla's internal authoring servers and are reviewed before being signed and published to this read-only surface. ### Can I limit what my agent is allowed to do with the Remote Settings API? Yes. Because you run Jentic One yourself, your own rules decide which Remote Settings operations and buckets the agent may touch. Remote Settings puts the bucket id in the URL path, so you can pin the agent to a single bucket such as main or security-state and let it read only that bucket's collections, records, and changesets. You also choose the exact operations it may call, so it stays on the public read-only feed and cannot reach any authoring or admin surface.