Where does an ACME directory's configuration live — a config file on the head's disk, edited by SSH? No: every enrollment interface is a versioned config resource behind one uniform API, exactly like the rest of goca's configuration.
GET /v1/config/resources?kind=AcmeEndpoint
PUT /v1/config/resources/AcmeEndpoint/web # body {"spec": {…}}
DELETE /v1/config/resources/AcmeEndpoint/web # tombstone; history kept
AcmeEndpoint, RestEndpoint, ScepEndpoint, EstEndpoint, CmpEndpoint — each a document with a name, versions, an author trail, and a form/YAML/JSON editor in the console under Interfaces. Nothing is applied until Save, and a starter never names an object that may not exist: a new endpoint's default template starts blank.
Two honesty rules of the config API are worth knowing. First: a document being accepted is not a head serving it — a ScepEndpoint saves and versions today while the SCEP head is roadmap (frame 54). Second: kinds this build cannot accept at all are refused with 400 unknown kind rather than stored and ignored — and the console's kind picker offers exactly the accepted set, because picker and gate read the same allowlist.
Now I can manage every enrollment door as a versioned document — and check which kinds my build accepts.