# Get the branding draft

`GET /v1/branding` · permission `branding:read`

Returns the environment's branding draft: theme tokens, custom CSS and page template. The draft is not live; hosted pages use the last published version (`POST /v1/branding:publish`). If nothing was written yet the theme is empty, `ETag` is `"0"` and `updated_at` is `null`. Send the `ETag` as `If-Match` on the next write.

## Request

This operation takes no path, query or body fields. The environment comes from the credential.

## Response

`200 OK` with the environment draft and its `ETag`. `theme` holds only the tokens that are set; unset tokens inherit from the platform default.

```json
{
  "theme": {"mode": "light", "light": {"color": {"primary": "#0a3d91"}}, "logo_height": 40},
  "css": null,
  "page_template": null,
  "updated_at": "2026-10-05T09:30:00.123456Z"
}
```

## Errors

| HTTP | code | When |
|---|---|---|
| 401 | `unauthenticated` | The credential is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The credential lacks the required permission. |
| 429 | `rate_limited` | The rate limit was exceeded; retry after the `Retry-After` period. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry after the `Retry-After` period. |

## Example

```bash
curl https://api.eu.keenauth.com/v1/branding \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```