PedMono API

Returns the signed-in user, refreshing the short-lived auth token when needed.

No input. Send {}.

Creates an account with a username, email and password, then signs it in.

Signs in with email and password. remember keeps the session for 30 days, otherwise it ends with the browser session.

Completes a Nitlix sign-in. Redeems the one-time ticket against the state cookie set by GET /auth/nitlix, linking or creating the account.

Ends the current session and clears the auth cookies.

No input. Send {}.

Emails a password reset link. Limited to 3 per account per hour. Always answers the same way, so it can't be used to discover accounts.

Checks a reset link before the new password is typed.

Sets a new password from a reset link and signs out every existing session.

Changes the password (or sets one for Nitlix-only accounts) and signs out every other session.

Lists the signed-in user's active sessions, newest first.

No input. Send {}.

Signs out one of the user's sessions.

Updates any of username, email, bio and preferences. Omitted fields stay as they are.

Step 1 of an upload. Reserves unverified objects and returns presigned R2 URLs to PUT WebP bytes to (Content-Type: image/webp). Confirm with upload_verify.

Step 2 of an upload. The worker HEADs each object in R2, checks its real size and type, and marks it verified. A new avatar set replaces the previous one.

Removes the user's avatar in every size.

No input. Send {}.

A user's public profile by username. List their posts with post_search and author.

Sets (or clears, with url: null) the webhook notified with a signed comment.created event whenever someone comments on one of your posts.

Sends a signed webhook.test event to the configured webhook and reports how it answered.

No input. Send {}.

Searches posts by title, content or tag, with sorting and pagination. Results only include posts the caller can see: public posts, their own, and (for admins) posts they made private. mine needs a session.

A post by id with its comments. Private posts are only visible to their author, or to the admin who made them private.

Opens a post through a temporary access link, even if it's private and the reader is signed out.

Creates a post. content is HTML and is sanitised against a whitelist. coverId is a verified cover_image upload. Limited by the author's max posts.

Edits any field of a post by id. Authors can edit their own posts. Admins can edit public posts and make them private; they keep access to posts they made private, but not to posts their author made private. coverId: null removes the cover.

Deletes one of your posts along with its comments, likes, share links and cover image.

Likes or unlikes a post you can see. A user can like a post once; repeating a like changes nothing.

Exports all of your posts. JSON embeds each cover image as base64 so the file can be re-imported anywhere; CSV is a flat table for spreadsheets.

Imports posts from JSON (an array, or this API's own export) or XML. Every post is created new; ids in the file are ignored. Invalid entries are skipped and reported.

Creates a temporary access link to a post you can see. It opens the post for anyone until it expires, is revoked, or you lose access to the post.

Active share links for a post: all of them for its author, otherwise just the ones you made.

Revokes a share link. Its creator or the post's author can do this.

Comments on any post you can read. The author's webhook (and email, if they opted in) is notified.

Edits one of your comments.

Deletes a comment. Its author can, and so can the post's author and admins who can see the post, to moderate.

Users by id, username or email, with their post counts and limits.

Promotes a user to admin by their user id.

Sets how many posts a user may have. Leave out userId to apply it to every user at once.

Activity log, newest first. Filter by user (id or username), action (exact, or a prefix ending in . like post.), IP prefix, user agent and an ISO date range.

The same filters as admin_logs, as a CSV file of up to 10000 rows.