Skip to content
Developers
Menu

API reference

Introduction

Basics

  • Base URL: https://api.palloo.app/v1. Every path in this reference is relative to it: GET /instance is GET https://api.palloo.app/v1/instance. The gateway is at wss://api.palloo.app/v1/gateway.
  • Log in with Palloo is the exception: its endpoints live on the issuer, https://app.palloo.app. Take their addresses from the discovery document, as Log in with Palloo explains.
  • Bodies are JSON (Content-Type: application/json), except file uploads. Unknown fields in a request body are refused with 400 invalid_body, so send only the fields listed.
  • IDs are ULIDs: 26 characters that sort in creation order. Permissions are 64-bit sets sent as decimal strings.
  • Errors have the shape {"error": {"code": "...", "message": "..."}}. Branch on code, never on message. See Errors.
  • Servers are called communities in the API. A community you are not in answers 404, exactly like one that does not exist.

This reference is generated from the Palloo server's OpenAPI document, version 0.1.0. It lists 131 operations: the ones a bot token, a webhook token or a Log in with Palloo app can call. Operations only a person's own account can use (sessions, passwords, friends, settings, creating servers, managing bots) and instance administration are left out.

Who can call what

LabelMeaning
Bot tokenTakes Authorization: Bearer palloo_bot_.... People's session tokens work too; the server applies the same permission checks to both.
Bots onlyOnly a bot token is accepted. A person's token gets 403 bot_required.
Webhook tokenAuthenticated by a webhook's own token, in the URL or as Authorization: Webhook palloo_wh_....
OAuth appPart of Log in with Palloo, called by a registered app.
No tokenOpen to anyone, such as the gateway upgrade and instance information.

Operations by group