Returns the effective value of each requested key in one call — the cold-start bulk fetch a restarting consumer re-reads the world through.

Platform-gated and read-scoped. Capped at 100 keys; an over-limit or empty request is rejected with 400 BEFORE any resolution. A key the catalog does not declare is OMITTED from the result rather than answered 404, so the endpoint is not a key-existence oracle.

A reserved routing key — one an own-table subsystem owns rather than the deployment catalog, such as the deployment key-protection descriptor — additionally requires the read scope that subsystem declares for itself, because its descriptor names cloud topology and is not a deployment scalar. A human caller that does not hold it is refused 403 for the whole request: the gate aborts the call, so a request for 50 catalog keys plus one reserved key returns 403 and no partial map. Serving the other 50 and silently omitting the reserved one would be indistinguishable from that key not being configured, which is the oracle the omission rule exists to prevent.

Service-to-service settings-warm callers are bounded differently: their per-issuer allow-list is narrower and key-exact, an out-of-list key is DROPPED exactly as an unknown key is, and no reserved-key scope is tested.

The two audiences receive different answers for the same key, and that is the contract. For the human platform reader, a catalog entry whose effective value is admin-api's own compiled default and whose affectedServices does not name admin-api is answered source: DEPLOYMENT_NOT_VISIBLE, value: null and a notVisibleReason — the same answer /catalog, /overrides and GET /{key} give, because admin-api's compiled default is not the deployment's value and publishing it as one is what this refusal removes. For a settings-warm S2S caller the raw precedence answer is returned unchanged: that value is what the warming service is starting up to get, and a null in its place would be dropped by the consumer as an absent key and leave it on compiled defaults for its whole process life. Reserved routing keys are outside the rule entirely.