Knowledge base›Sources›Alin Radulescu (GPTSpy)
A HAR dissection of the ChatGPT web app: one BFF gateway under /backend-api/*, SPA assets from oaistatic, a Cloudflare edge, sentinel gating with proof-of-work, a WebSocket channel, the conversation object as a mapping graph with current_node, metadata fields for citations and search results, widget retrieval via ecosystem/widget and tool execution via ecosystem/call_mcp. Throughout, the piece separates "proven in the HAR" from "plausible, not provable".
Transparency: the author runs this project. The analysis was groundwork for GPTSpy — it is treated here like any external source: dated, broken into claims, held against the measurements.
The central December 2025 finding — the conversation object as a mapping graph — is exactly the structure the baseline still measured on 20 Aug 2026, and it flipped one day later: the switch to /backend-api/conversations/{id} with a messages list became the first confirmed event of this tracker. The source thus demonstrates in its own register what the register is built for: statements age, and without a date nobody knows since when. Gateway, sentinel chain and WebSocket upgrade measure unchanged to this day.
| Claim | Status | Evidence |
|---|---|---|
| Conversation retrieval via GET /backend-api/conversation/{id}: canonical object with a mapping node graph and current_node as branch pointer | outdated | Accurate up to the baseline on 20 Aug 2026 (mapping format measured). On 21 Aug 2026 the endpoint switched to /backend-api/conversations/{id} with a messages list — the first confirmed event of this tracker. |
| message.metadata carries citations, search_result_groups, invoked_resource, async_task_id | confirmed | citations and search_result_groups are core fields of the daily extraction; the remaining metadata fields appear case by case in the snapshots. |
| Security gating via POST /backend-api/sentinel/chat-requirements prepare/finalize (Turnstile + proof-of-work) | confirmed | Both endpoints appear in endpoints_seen on every measuring day, alongside sentinel/ping and sentinel/req (as of 25 Aug 2026). |
| One public BFF gateway chatgpt.com/backend-api/* in front of all services, WebSocket upgrade via GET /backend-api/celsius/ws/user to wss://ws.chatgpt.com | confirmed | 51 endpoints under /backend-api in the inventory of 25 Aug 2026, celsius/ws/user among them. |