reqistry-dev Contact API

openapi: 3.2.0
info:
  title: Public APIs — Mobile Client Contact API
  description: 'API reference for the Public APIs Flutter mobile app. Includes anonymous device auth, email/password account linking, profile management, bookmarks, folders, discovery, categories, search, and legacy JSON endpoints.


    ## Authentication


    Bearer-protected endpoints require:


    ```

    Authorization: Bearer

    ```


    Tokens are obtained via `POST /v1/auth/anonymous` or `POST /v1/auth/login-email`.


    Public endpoints (no token required): `POST /submit`, `POST /v1/apis` (auth optional, enables submission attribution), `POST /v1/auth/anonymous`, `POST /v1/auth/refresh`, `POST /v1/auth/revoke`, `POST /v1/auth/login-email`, `GET /v1/recently-added`, `GET /v1/recommend` (auth optional, personalizes with bookmarks), `GET /v1/apis/{slug}`, `GET /v1/apis/{id}/alternatives`, `GET /v1/trust-scores/{id}`, `GET /v1/apis/compare`, `GET /v1/change-feed`, `GET /v1/use-case-collections`, categories (unversioned and `/v1` aliases), `GET /search`, `GET /metadata`, `POST /track`, and `POST /admin/v1/contact-messages`. Every other `/v1/*` operation requires a Bearer token.


    ## Account Types

    - **Anonymous**: Device-only, no email. Data tied to device fingerprint.

    - **Email-linked**: Has email + password. Can login from any device. Data merges on link.


    ## Token Lifecycle

    - **Access token**: 15 minutes, used for API requests

    - **Refresh token**: 30 days, used to rotate access tokens

    - Refreshing a token invalidates the old one (single-use rotation)

    - Revoking deactivates all tokens for a device'
  version: 1.0.0
  contact:
    name: Public APIs
    url: '---'
servers:
- url: http://localhost:4000
  description: Local development
- url: '---'
  description: Production
tags:
- name: Contact
paths:
  /admin/v1/contact-messages:
    post:
      tags:
      - Contact
      summary: Send a contact message
      description: Public contact form intake. Creates a message for the team to read; admin listing lives outside the mobile contract.
      operationId: sendContactMessage
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ContactMessageRequest'
      responses:
        '201':
          description: Message sent
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ContactMessageResponse'
        '400':
          description: Validation error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  schemas:
    ContactMessageResponse:
      type: object
      required:
      - success
      - message
      - id
      properties:
        success:
          type: boolean
        message:
          type: string
        id:
          type: string
    ContactMessageRequest:
      type: object
      required:
      - name
      - email
      - message
      properties:
        name:
          type: string
          minLength: 1
          maxLength: 200
        email:
          type: string
          format: email
          maxLength: 300
        subject:
          type: string
          maxLength: 500
          default: ''
        message:
          type: string
          minLength: 1
          maxLength: 10000
    Error:
      type: object
      properties:
        error:
          type: string
      required:
      - error
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Anonymous device access token from POST /v1/auth/anonymous