Skip to main content

API

Kong terminates the public prefix. Upstream paths below do not include /api.

  • Friendships and friend requests under /v1/social/friendships and request routes.
  • Groups, members, invitations, and group QR under /v1/social/groups.
  • Blocks, discovery, nearby, search history, notes, and custom emoji.
  • GET /v1/public/users/{username} for public profiles.
  • Internal /internal/v1/social/* for feed, messaging, and notification lookups.

The HTTP contract is OpenAPI. When a route changes, update splick-backend/openapi/openapi.yaml in the same change as the controller.

Auth​

  • Public user routes expect a bearer access token issued by auth-service. Kong does not validate the JWT.
  • Service-to-service routes use INTERNAL_API_KEY. Do not document or commit the value.
  • Rate limits for auth-sensitive routes are declared per route in splick-backend/infra/kong/kong.yml.