API Documentation

login

POST /api.php · Auth: none

Signs in and returns a JWT for protected actions.

{
  "valid": true,
  "message": "Login successful",
  "userId": 26,
  "jwt": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

logout

POST /api.php · Auth: none (send the token to invalidate it)

Invalidates the token sent in the Authorization header. Always succeeds.

{ "valid": true, "message": "Logged out" }

sendRegisterOTP

POST /api.php · Auth: none

Step 1 of registration. Emails a 6-digit code that is valid for 10 minutes. Requesting again replaces the previous code.

{ "valid": true, "message": "OTP sent to your email. Check inbox/spam." }

verifyRegisterOTP

POST /api.php · Auth: none

Step 2 of registration. Checks the emailed code. After it succeeds, you have 10 minutes to call finishRegister.

{ "valid": true, "message": "OTP verified! Set your password." }

finishRegister

POST /api.php · Auth: none

Step 3 of registration. Call within 10 minutes after verifyRegisterOTP succeeds. Afterwards, call login.

{ "valid": true, "message": "Account created successfully!" }

sendOTP

POST /api.php · Auth: none

Step 1 of a password reset. Emails a 6-digit code that is valid for 10 minutes.

{ "valid": true, "message": "OTP sent to your email. Check inbox/spam." }

verifyOTP

POST /api.php · Auth: none

Step 2 of a password reset. Checks the emailed code. After it succeeds, you have 10 minutes to call resetPassword.

{ "valid": true, "message": "OTP verified! Set your new password." }

resetPassword

POST /api.php · Auth: none

Step 3 of a password reset. Call within 10 minutes after verifyOTP succeeds. Each verification allows one reset.

{ "valid": true, "message": "Password reset successful! Please log in." }

deleteAccount

POST /api.php · Auth: required

Permanently deletes your account, posts, comments, likes, follows, notifications, and uploaded media. This cannot be undone.

{ "valid": true, "message": "Account deleted successfully" }

getMyInfo

POST /api.php · Auth: required

Returns the signed-in user. id and userId are the same value.

{
  "valid": true,
  "id": 26,
  "userId": 26,
  "email": "davefruin@gmail.com",
  "created_at": "2026-04-13 22:17:00"
}

getUserInfo

POST /api.php · Auth: required

Returns another user's email and join date. created_at is "Unknown" if it wasn't recorded.

{ "valid": true, "email": "annabegomez@gmail.com", "created_at": "2026-02-25 22:54:00" }

getUsers

POST /api.php · Auth: required

Returns every user except you, sorted by email.

{
  "valid": true,
  "users": [
    { "id": 8, "email": "annabegomez@gmail.com", "created_at": "2026-02-25 22:54:00" }
  ]
}

getUserEmails

POST /api.php · Auth: required

Looks up emails for a list of user IDs. The result is keyed by user ID. IDs that don't exist are left out.

{ "valid": true, "emails": { "1": "me@davidfruin.com", "8": "annabegomez@gmail.com" } }

post

POST /api.php · Auth: required

Creates a post. To attach media, upload it first with uploadMedia and pass the returned mediaUrl.

{ "valid": true, "postId": "26.1789611603" }

deletePost

POST /api.php · Auth: required

Deletes one of your posts, along with its media and related notifications.

{ "valid": true, "deleted": true }

getPostById

POST /api.php · Auth: required

Returns a single post object.

{ "valid": true, "post": { "id": "26.1789611603", "text": "...", ... } }

getMyPosts

POST /api.php · Auth: required

Your posts, newest first. totalCount is the total across all pages. hasMore tells you whether to request the next page.

{ "valid": true, "posts": [ ... ], "hasMore": true, "totalCount": 42 }

getUserPosts

POST /api.php · Auth: required

A user's posts, newest first. The response format is the same as getMyPosts.

{ "valid": true, "posts": [ ... ], "hasMore": false, "totalCount": 1 }

fetchFollowedPosts

POST /api.php · Auth: required

Your news feed: posts from everyone you follow plus your own, newest first. The response format is the same as getMyPosts.

{ "valid": true, "posts": [ ... ], "hasMore": true, "totalCount": 130 }

getPostPreviews

POST /api.php · Auth: required

Short previews for a list of posts: the first 25 characters of each post's text followed by .... Posts that don't exist or have no text are left out.

{ "valid": true, "previews": { "26.1789611603": "Testing the new interactiv..." } }

likePost

POST /api.php · Auth: required

Likes a post and notifies its owner. Liking a post you already liked does nothing.

{ "valid": true, "liked": true }

unlikePost

POST /api.php · Auth: required

Removes your like from a post.

{ "valid": true, "liked": false }

getPostLikes

POST /api.php · Auth: required

Who liked a post. Use getUserEmails to look up their emails.

{ "valid": true, "likes": [ { "userId": 1, "timestamp": "2026-09-16 19:43:02" } ] }

createComment

POST /api.php · Auth: required

Adds a comment and notifies the post owner. commentId is returned as a string.

{ "valid": true, "commentId": "64" }

getPostComments

POST /api.php · Auth: required

A post's comments, newest first.

{
  "valid": true,
  "comments": [
    {
      "id": 64,
      "post_id": "26.1789611751",
      "user_id": 26,
      "text": "Test comment",
      "created_at": "2026-09-16 19:22:39",
      "user_email": "davefruin@gmail.com"
    }
  ],
  "hasMore": false,
  "totalCount": 1
}

deleteComment

POST /api.php · Auth: required

Deletes one of your comments.

{ "valid": true, "deleted": true }

getPostCommentCounts

POST /api.php · Auth: required

Comment counts for a list of posts, keyed by post ID.

{ "valid": true, "counts": { "26.1789611603": 0, "8.1": 3 } }

followUser

POST /api.php · Auth: required

Follows a user and notifies them. Following someone you already follow does nothing.

{ "valid": true, "following": true }

unfollowUser

POST /api.php · Auth: required

Unfollows a user and notifies them.

{ "valid": true, "following": false }

isFollowing

POST /api.php · Auth: required

Whether you follow a user.

{ "valid": true, "following": true }

getMyFollows

POST /api.php · Auth: required

Who a user follows, defaulting to you. timestamp is when they followed, or "Unknown" for very old follows.

{
  "valid": true,
  "follows": [
    { "id": 8, "email": "annabegomez@gmail.com", "timestamp": "2026-04-13 22:54:31" }
  ]
}

getMyFollowers

POST /api.php · Auth: required

Who follows a user, defaulting to you. Entries have the same format as getMyFollows.

{
  "valid": true,
  "followers": [
    { "id": 1, "email": "me@davidfruin.com", "timestamp": "2026-04-27 14:41:50" }
  ]
}

getNotifications

POST /api.php · Auth: required

Your notifications, newest first, 25 at a time. Request the next page with offset until fewer than 25 come back. type is one of follow, unfollow, like, unlike, or comment. post_id is null for follow notifications.

{
  "valid": true,
  "notifications": [
    {
      "id": 120,
      "recipient_id": 26,
      "actor_id": 1,
      "actor_email": "me@davidfruin.com",
      "type": "like",
      "post_id": "26.1789611603",
      "created_at": "2026-09-16 19:43:02"
    }
  ]
}

getUnseenNotificationCount

POST /api.php · Auth: required

How many notifications arrived since you last called markNotificationsSeen.

{ "valid": true, "count": 3 }

markNotificationsSeen

POST /api.php · Auth: required

Resets your unseen notification count to zero.

{ "valid": true, "message": "Notifications marked as seen" }

uploadMedia

POST /media.php · multipart/form-data · Auth: required

Uploads a file to attach to a post. Pass the returned mediaUrl to post. mediaId is returned as a string.

• Images are turned upright using their EXIF orientation, converted to WebP, and scaled so the longest side is at most 1920px.
• Video is converted to MP4 (H.264/AAC) with the longest side at most 1920px. thumbnailUrl is a WebP of the first frame.
• Audio is converted to MP3.
• If a video or audio file can't be converted, the original is kept, so check the extension of mediaUrl rather than assuming the format. thumbnailUrl is null for images, audio, and videos without a thumbnail.

{
  "valid": true,
  "mediaId": "12",
  "mediaUrl": "/media/26/image/26_image_20260916192002_591227.webp",
  "thumbnailUrl": null,
  "type": "image"
}

deleteMedia

POST /media.php · Auth: required

Deletes a file you uploaded, for example if creating the post failed. Deleting a post already deletes its media.

{ "valid": true, "deleted": true }

log

POST /api.php · Auth: required

Used by the website to report client-side errors. Third-party front ends don't need it.

{ "valid": true, "message": "Logged" }