mastodon API: do not sanitize html in non-html fields
[akkoma] / docs / API / pleroma_api.md
1 # Pleroma API
2
3 Requests that require it can be authenticated with [an OAuth token](https://tools.ietf.org/html/rfc6749), the `_pleroma_key` cookie, or [HTTP Basic Authentication](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Authorization).
4
5 Request parameters can be passed via [query strings](https://en.wikipedia.org/wiki/Query_string) or as [form data](https://www.w3.org/TR/html401/interact/forms.html). Files must be uploaded as `multipart/form-data`.
6
7 ## `/api/pleroma/emoji`
8 ### Lists the custom emoji on that server.
9 * Method: `GET`
10 * Authentication: not required
11 * Params: none
12 * Response: JSON
13 * Example response:
14 ```json
15 {
16 "girlpower": {
17 "tags": [
18 "Finmoji"
19 ],
20 "image_url": "/finmoji/128px/girlpower-128.png"
21 },
22 "education": {
23 "tags": [
24 "Finmoji"
25 ],
26 "image_url": "/finmoji/128px/education-128.png"
27 },
28 "finnishlove": {
29 "tags": [
30 "Finmoji"
31 ],
32 "image_url": "/finmoji/128px/finnishlove-128.png"
33 }
34 }
35 ```
36 * Note: Same data as Mastodon API’s `/api/v1/custom_emojis` but in a different format
37
38 ## `/api/pleroma/follow_import`
39 ### Imports your follows, for example from a Mastodon CSV file.
40 * Method: `POST`
41 * Authentication: required
42 * Params:
43 * `list`: STRING or FILE containing a whitespace-separated list of accounts to follow
44 * Response: HTTP 200 on success, 500 on error
45 * Note: Users that can't be followed are silently skipped.
46
47 ## `/api/pleroma/captcha`
48 ### Get a new captcha
49 * Method: `GET`
50 * Authentication: not required
51 * Params: none
52 * Response: Provider specific JSON, the only guaranteed parameter is `type`
53 * Example response: `{"type": "kocaptcha", "token": "whatever", "url": "https://captcha.kotobank.ch/endpoint"}`
54
55 ## `/api/pleroma/delete_account`
56 ### Delete an account
57 * Method `POST`
58 * Authentication: required
59 * Params:
60 * `password`: user's password
61 * Response: JSON. Returns `{"status": "success"}` if the deletion was successful, `{"error": "[error message]"}` otherwise
62 * Example response: `{"error": "Invalid password."}`
63
64 ## `/api/pleroma/disable_account`
65 ### Disable an account
66 * Method `POST`
67 * Authentication: required
68 * Params:
69 * `password`: user's password
70 * Response: JSON. Returns `{"status": "success"}` if the account was successfully disabled, `{"error": "[error message]"}` otherwise
71 * Example response: `{"error": "Invalid password."}`
72
73 ## `/api/pleroma/admin/`…
74 See [Admin-API](admin_api.md)
75
76 ## `/api/v1/pleroma/notifications/read`
77 ### Mark notifications as read
78 * Method `POST`
79 * Authentication: required
80 * Params (mutually exclusive):
81 * `id`: a single notification id to read
82 * `max_id`: read all notifications up to this id
83 * Response: Notification entity/Array of Notification entities that were read. In case of `max_id`, only the first 80 read notifications will be returned.
84
85 ## `/api/v1/pleroma/accounts/:id/subscribe`
86 ### Subscribe to receive notifications for all statuses posted by a user
87 * Method `POST`
88 * Authentication: required
89 * Params:
90 * `id`: account id to subscribe to
91 * Response: JSON, returns a mastodon relationship object on success, otherwise returns `{"error": "error_msg"}`
92 * Example response:
93 ```json
94 {
95 "id": "abcdefg",
96 "following": true,
97 "followed_by": false,
98 "blocking": false,
99 "muting": false,
100 "muting_notifications": false,
101 "subscribing": true,
102 "requested": false,
103 "domain_blocking": false,
104 "showing_reblogs": true,
105 "endorsed": false
106 }
107 ```
108
109 ## `/api/v1/pleroma/accounts/:id/unsubscribe`
110 ### Unsubscribe to stop receiving notifications from user statuses
111 * Method `POST`
112 * Authentication: required
113 * Params:
114 * `id`: account id to unsubscribe from
115 * Response: JSON, returns a mastodon relationship object on success, otherwise returns `{"error": "error_msg"}`
116 * Example response:
117 ```json
118 {
119 "id": "abcdefg",
120 "following": true,
121 "followed_by": false,
122 "blocking": false,
123 "muting": false,
124 "muting_notifications": false,
125 "subscribing": false,
126 "requested": false,
127 "domain_blocking": false,
128 "showing_reblogs": true,
129 "endorsed": false
130 }
131 ```
132
133 ## `/api/v1/pleroma/accounts/:id/favourites`
134 ### Returns favorites timeline of any user
135 * Method `GET`
136 * Authentication: not required
137 * Params:
138 * `id`: the id of the account for whom to return results
139 * `limit`: optional, the number of records to retrieve
140 * `since_id`: optional, returns results that are more recent than the specified id
141 * `max_id`: optional, returns results that are older than the specified id
142 * Response: JSON, returns a list of Mastodon Status entities on success, otherwise returns `{"error": "error_msg"}`
143 * Example response:
144 ```json
145 [
146 {
147 "account": {
148 "id": "9hptFmUF3ztxYh3Svg",
149 "url": "https://pleroma.example.org/users/nick2",
150 "username": "nick2",
151 ...
152 },
153 "application": {"name": "Web", "website": null},
154 "bookmarked": false,
155 "card": null,
156 "content": "This is :moominmamma: note 0",
157 "created_at": "2019-04-15T15:42:15.000Z",
158 "emojis": [],
159 "favourited": false,
160 "favourites_count": 1,
161 "id": "9hptFmVJ02khbzYJaS",
162 "in_reply_to_account_id": null,
163 "in_reply_to_id": null,
164 "language": null,
165 "media_attachments": [],
166 "mentions": [],
167 "muted": false,
168 "pinned": false,
169 "pleroma": {
170 "content": {"text/plain": "This is :moominmamma: note 0"},
171 "conversation_id": 13679,
172 "local": true,
173 "spoiler_text": {"text/plain": "2hu"}
174 },
175 "reblog": null,
176 "reblogged": false,
177 "reblogs_count": 0,
178 "replies_count": 0,
179 "sensitive": false,
180 "spoiler_text": "2hu",
181 "tags": [{"name": "2hu", "url": "/tag/2hu"}],
182 "uri": "https://pleroma.example.org/objects/198ed2a1-7912-4482-b559-244a0369e984",
183 "url": "https://pleroma.example.org/notice/9hptFmVJ02khbzYJaS",
184 "visibility": "public"
185 }
186 ]
187 ```
188
189 ## `/api/v1/pleroma/accounts/update_*`
190 ### Set and clear account avatar, banner, and background
191
192 - PATCH `/api/v1/pleroma/accounts/update_avatar`: Set/clear user avatar image
193 - PATCH `/api/v1/pleroma/accounts/update_banner`: Set/clear user banner image
194 - PATCH `/api/v1/pleroma/accounts/update_background`: Set/clear user background image
195
196 ## `/api/v1/pleroma/accounts/confirmation_resend`
197 ### Resend confirmation email
198 * Method `POST`
199 * Params:
200 * `email`: email of that needs to be verified
201 * Authentication: not required
202 * Response: 204 No Content
203
204 ## `/api/v1/pleroma/mascot`
205 ### Gets user mascot image
206 * Method `GET`
207 * Authentication: required
208
209 * Response: JSON. Returns a mastodon media attachment entity.
210 * Example response:
211 ```json
212 {
213 "id": "abcdefg",
214 "url": "https://pleroma.example.org/media/abcdefg.png",
215 "type": "image",
216 "pleroma": {
217 "mime_type": "image/png"
218 }
219 }
220 ```
221
222 ### Updates user mascot image
223 * Method `PUT`
224 * Authentication: required
225 * Params:
226 * `image`: Multipart image
227 * Response: JSON. Returns a mastodon media attachment entity
228 when successful, otherwise returns HTTP 415 `{"error": "error_msg"}`
229 * Example response:
230 ```json
231 {
232 "id": "abcdefg",
233 "url": "https://pleroma.example.org/media/abcdefg.png",
234 "type": "image",
235 "pleroma": {
236 "mime_type": "image/png"
237 }
238 }
239 ```
240 * Note: Behaves exactly the same as `POST /api/v1/upload`.
241 Can only accept images - any attempt to upload non-image files will be met with `HTTP 415 Unsupported Media Type`.
242
243 ## `/api/pleroma/notification_settings`
244 ### Updates user notification settings
245 * Method `PUT`
246 * Authentication: required
247 * Params:
248 * `followers`: BOOLEAN field, receives notifications from followers
249 * `follows`: BOOLEAN field, receives notifications from people the user follows
250 * `remote`: BOOLEAN field, receives notifications from people on remote instances
251 * `local`: BOOLEAN field, receives notifications from people on the local instance
252 * `privacy_option`: BOOLEAN field. When set to true, it removes the contents of a message from the push notification.
253 * Response: JSON. Returns `{"status": "success"}` if the update was successful, otherwise returns `{"error": "error_msg"}`
254
255 ## `/api/pleroma/healthcheck`
256 ### Healthcheck endpoint with additional system data.
257 * Method `GET`
258 * Authentication: not required
259 * Params: none
260 * Response: JSON, statuses (200 - healthy, 503 unhealthy).
261 * Example response:
262 ```json
263 {
264 "pool_size": 0, # database connection pool
265 "active": 0, # active processes
266 "idle": 0, # idle processes
267 "memory_used": 0.00, # Memory used
268 "healthy": true, # Instance state
269 "job_queue_stats": {} # Job queue stats
270 }
271 ```
272
273 ## `/api/pleroma/change_email`
274 ### Change account email
275 * Method `POST`
276 * Authentication: required
277 * Params:
278 * `password`: user's password
279 * `email`: new email
280 * Response: JSON. Returns `{"status": "success"}` if the change was successful, `{"error": "[error message]"}` otherwise
281 * Note: Currently, Mastodon has no API for changing email. If they add it in future it might be incompatible with Pleroma.
282
283 # Pleroma Conversations
284
285 Pleroma Conversations have the same general structure that Mastodon Conversations have. The behavior differs in the following ways when using these endpoints:
286
287 1. Pleroma Conversations never add or remove recipients, unless explicitly changed by the user.
288 2. Pleroma Conversations statuses can be requested by Conversation id.
289 3. Pleroma Conversations can be replied to.
290
291 Conversations have the additional field "recipients" under the "pleroma" key. This holds a list of all the accounts that will receive a message in this conversation.
292
293 The status posting endpoint takes an additional parameter, `in_reply_to_conversation_id`, which, when set, will set the visiblity to direct and address only the people who are the recipients of that Conversation.
294
295
296 ## `GET /api/v1/pleroma/conversations/:id/statuses`
297 ### Timeline for a given conversation
298 * Method `GET`
299 * Authentication: required
300 * Params: Like other timelines
301 * Response: JSON, statuses (200 - healthy, 503 unhealthy).
302
303 ## `GET /api/v1/pleroma/conversations/:id`
304 ### The conversation with the given ID.
305 * Method `GET`
306 * Authentication: required
307 * Params: None
308 * Response: JSON, statuses (200 - healthy, 503 unhealthy).
309
310 ## `PATCH /api/v1/pleroma/conversations/:id`
311 ### Update a conversation. Used to change the set of recipients.
312 * Method `PATCH`
313 * Authentication: required
314 * Params:
315 * `recipients`: A list of ids of users that should receive posts to this conversation. This will replace the current list of recipients, so submit the full list. The owner of owner of the conversation will always be part of the set of recipients, though.
316 * Response: JSON, statuses (200 - healthy, 503 unhealthy)
317
318 ## `GET /api/v1/pleroma/conversations/read`
319 ### Marks all user's conversations as read.
320 * Method `POST`
321 * Authentication: required
322 * Params: None
323 * Response: JSON, returns a list of Mastodon Conversation entities that were marked as read (200 - healthy, 503 unhealthy).
324
325 ## `GET /api/pleroma/emoji/packs`
326 ### Lists the custom emoji packs on the server
327 * Method `GET`
328 * Authentication: not required
329 * Params: None
330 * Response: JSON, "ok" and 200 status and the JSON hashmap of "pack name" to "pack contents"
331
332 ## `PUT /api/pleroma/emoji/packs/:name`
333 ### Creates an empty custom emoji pack
334 * Method `PUT`
335 * Authentication: required
336 * Params: None
337 * Response: JSON, "ok" and 200 status or 409 if the pack with that name already exists
338
339 ## `DELETE /api/pleroma/emoji/packs/:name`
340 ### Delete a custom emoji pack
341 * Method `DELETE`
342 * Authentication: required
343 * Params: None
344 * Response: JSON, "ok" and 200 status or 500 if there was an error deleting the pack
345
346 ## `POST /api/pleroma/emoji/packs/:name/update_file`
347 ### Update a file in a custom emoji pack
348 * Method `POST`
349 * Authentication: required
350 * Params:
351 * if the `action` is `add`, adds an emoji named `shortcode` to the pack `pack_name`,
352 that means that the emoji file needs to be uploaded with the request
353 (thus requiring it to be a multipart request) and be named `file`.
354 There can also be an optional `filename` that will be the new emoji file name
355 (if it's not there, the name will be taken from the uploaded file).
356 * if the `action` is `update`, changes emoji shortcode
357 (from `shortcode` to `new_shortcode` or moves the file (from the current filename to `new_filename`)
358 * if the `action` is `remove`, removes the emoji named `shortcode` and it's associated file
359 * Response: JSON, updated "files" section of the pack and 200 status, 409 if the trying to use a shortcode
360 that is already taken, 400 if there was an error with the shortcode, filename or file (additional info
361 in the "error" part of the response JSON)
362
363 ## `POST /api/pleroma/emoji/packs/:name/update_metadata`
364 ### Updates (replaces) pack metadata
365 * Method `POST`
366 * Authentication: required
367 * Params:
368 * `new_data`: new metadata to replace the old one
369 * Response: JSON, updated "metadata" section of the pack and 200 status or 400 if there was a
370 problem with the new metadata (the error is specified in the "error" part of the response JSON)
371
372 ## `POST /api/pleroma/emoji/packs/download_from`
373 ### Requests the instance to download the pack from another instance
374 * Method `POST`
375 * Authentication: required
376 * Params:
377 * `instance_address`: the address of the instance to download from
378 * `pack_name`: the pack to download from that instance
379 * Response: JSON, "ok" and 200 status if the pack was downloaded, or 500 if there were
380 errors downloading the pack
381
382 ## `POST /api/pleroma/emoji/packs/list_from`
383 ### Requests the instance to list the packs from another instance
384 * Method `POST`
385 * Authentication: required
386 * Params:
387 * `instance_address`: the address of the instance to download from
388 * Response: JSON with the pack list, same as if the request was made to that instance's
389 list endpoint directly + 200 status
390
391 ## `GET /api/pleroma/emoji/packs/:name/download_shared`
392 ### Requests a local pack from the instance
393 * Method `GET`
394 * Authentication: not required
395 * Params: None
396 * Response: the archive of the pack with a 200 status code, 403 if the pack is not set as shared,
397 404 if the pack does not exist
398
399 ## `GET /api/v1/pleroma/accounts/:id/scrobbles`
400 ### Requests a list of current and recent Listen activities for an account
401 * Method `GET`
402 * Authentication: not required
403 * Params: None
404 * Response: An array of media metadata entities.
405 * Example response:
406 ```json
407 [
408 {
409 "account": {...},
410 "id": "1234",
411 "title": "Some Title",
412 "artist": "Some Artist",
413 "album": "Some Album",
414 "length": 180000,
415 "created_at": "2019-09-28T12:40:45.000Z"
416 }
417 ]
418 ```
419
420 ## `POST /api/v1/pleroma/scrobble`
421 ### Creates a new Listen activity for an account
422 * Method `POST`
423 * Authentication: required
424 * Params:
425 * `title`: the title of the media playing
426 * `album`: the album of the media playing [optional]
427 * `artist`: the artist of the media playing [optional]
428 * `length`: the length of the media playing [optional]
429 * Response: the newly created media metadata entity representing the Listen activity
430
431 # Emoji Reactions
432
433 Emoji reactions work a lot like favourites do. They make it possible to react to a post with a single emoji character.
434
435 ## `POST /api/v1/pleroma/statuses/:id/react_with_emoji`
436 ### React to a post with a unicode emoji
437 * Method: `POST`
438 * Authentication: required
439 * Params: `emoji`: A single character unicode emoji
440 * Response: JSON, the status.
441
442 ## `POST /api/v1/pleroma/statuses/:id/unreact_with_emoji`
443 ### Remove a reaction to a post with a unicode emoji
444 * Method: `POST`
445 * Authentication: required
446 * Params: `emoji`: A single character unicode emoji
447 * Response: JSON, the status.
448
449 ## `GET /api/v1/pleroma/statuses/:id/emoji_reactions_by`
450 ### Get an object of emoji to account mappings with accounts that reacted to the post
451 * Method: `GET`
452 * Authentication: optional
453 * Params: None
454 * Response: JSON, a list of emoji/account list tuples, sorted by emoji insertion date, in ascending order, e.g, the first emoji in the list is the oldest.
455 * Example Response:
456 ```json
457 [
458 {"emoji": "😀", "count": 2, "accounts": [{"id" => "xyz.."...}, {"id" => "zyx..."}]},
459 {"emoji": "☕", "count": 1, "accounts": [{"id" => "abc..."}]}
460 ]
461 ```