Skip to main content

API

Kong terminates the public prefix. Upstream paths below do not include /api.

  • FeedController /v1/feed — posts, comments, reactions, hides, reports, viewers, payment evidence, streaks, reminders.
  • GET /v1/public/posts/{postId} preview.
  • /v1/app/startup, android-release, ios-release.
  • Admin moderation under /v1/admin/post-reports, /v1/admin/posts, /v1/admin/app-releases.
  • Sticker favorites under /v1/stickers/favorites and /v1/feed/sticker-favorites.
  • Internal /internal/v1/feed/* for unseen counts, stats, and bulk-settlement evidence.

The HTTP contract is OpenAPI. When a route changes, update splick-backend/openapi/openapi.yaml in the same change as the controller.

Auth​

  • Public user routes expect a bearer access token issued by auth-service. Kong does not validate the JWT.
  • Service-to-service routes use INTERNAL_API_KEY. Do not document or commit the value.
  • Rate limits for auth-sensitive routes are declared per route in splick-backend/infra/kong/kong.yml.