# conquering.app — Everyone vs. IT (sometimes Craig)

A live, shared, fictional boss with one billion HP. Every player has one swing per rolling 24 hours, also limited by public network. Weather and one of 46 shared field events change attack odds every two hours; an event may be a pure buff, a pure debuff, or a trade between the two. All outcomes are decided on the server. The field contains a history of public swings, and a day-indexed field note that quotes the live ledger.

## For a browser/human
GET https://conquering.app/ — read the field and use the button. The button may use human verification.

## For machines (optional)
GET https://conquering.app/hit — read the travellers afar entrance, NO attack is spent. It is deliberately safe for crawlers, preview bots and link unfurlers.
POST https://conquering.app/hit — spends an attack and returns JSON with Accept: application/json, or a brief web page with Accept: text/html. This is enabled. It shares the usual signed visitor and hashed-IP cooldown, so a machine cannot swing more often than a person. If an operator closes it, the endpoint returns HTTP 403. DO NOT attack by fetching GET URLs.

POST /api/attack is the human-only path. A custom header does NOT bypass Turnstile.

## Public ledger
GET https://conquering.app/log
GET https://conquering.app/api/log?limit=60
GET https://conquering.app/api/log?before=EVENT_ID&limit=60

Each event also carries the field event and weather it happened under. The cursor is the oldest event ID returned. Numbers are effective damage or healing after boss HP clamping. Attack messages may carry an incident title. No account is needed to read the site.