reqistry-dev Metadata API

openapi: 3.2.0
info:
  title: Public APIs — Mobile Client Metadata API
  description: 'API reference for the Public APIs Flutter mobile app. Includes anonymous device auth, email/password account linking, profile management, bookmarks, folders, discovery, categories, search, and legacy JSON endpoints.


    ## Authentication


    Bearer-protected endpoints require:


    ```

    Authorization: Bearer

    ```


    Tokens are obtained via `POST /v1/auth/anonymous` or `POST /v1/auth/login-email`.


    Public endpoints (no token required): `POST /submit`, `POST /v1/apis` (auth optional, enables submission attribution), `POST /v1/auth/anonymous`, `POST /v1/auth/refresh`, `POST /v1/auth/revoke`, `POST /v1/auth/login-email`, `GET /v1/recently-added`, `GET /v1/recommend` (auth optional, personalizes with bookmarks), `GET /v1/apis/{slug}`, `GET /v1/apis/{id}/alternatives`, `GET /v1/trust-scores/{id}`, `GET /v1/apis/compare`, `GET /v1/change-feed`, `GET /v1/use-case-collections`, categories (unversioned and `/v1` aliases), `GET /search`, `GET /metadata`, `POST /track`, and `POST /admin/v1/contact-messages`. Every other `/v1/*` operation requires a Bearer token.


    ## Account Types

    - **Anonymous**: Device-only, no email. Data tied to device fingerprint.

    - **Email-linked**: Has email + password. Can login from any device. Data merges on link.


    ## Token Lifecycle

    - **Access token**: 15 minutes, used for API requests

    - **Refresh token**: 30 days, used to rotate access tokens

    - Refreshing a token invalidates the old one (single-use rotation)

    - Revoking deactivates all tokens for a device'
  version: 1.0.0
  contact:
    name: Public APIs
    url: '---'
servers:
- url: http://localhost:4000
  description: Local development
- url: '---'
  description: Production
tags:
- name: Metadata
  description: URL metadata extraction
paths:
  /metadata:
    get:
      tags:
      - Metadata
      summary: Fetch URL metadata
      description: Extract title, description, and Open Graph image from a URL. Uses a 5-second timeout. Private network addresses (localhost, 169.254.x.x, etc.) are blocked.
      operationId: getMetadata
      parameters:
      - name: url
        in: query
        required: true
        schema:
          type: string
          format: uri
        description: URL to fetch metadata from
      responses:
        '200':
          description: Metadata extracted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MetadataResponse'
        '400':
          description: Missing or invalid URL
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Access to private networks is forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '502':
          description: Failed to fetch metadata from target URL
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  schemas:
    MetadataResponse:
      type: object
      properties:
        title:
          type: string
          nullable: true
        description:
          type: string
          nullable: true
        ogImage:
          type: string
          format: uri
          nullable: true
    Error:
      type: object
      properties:
        error:
          type: string
      required:
      - error
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Anonymous device access token from POST /v1/auth/anonymous