reqistry-dev Tracking API

openapi: 3.2.0
info:
  title: Public APIs — Mobile Client Tracking API
  description: 'API reference for the Public APIs Flutter mobile app. Includes anonymous device auth, email/password account linking, profile management, bookmarks, folders, discovery, categories, search, and legacy JSON endpoints.


    ## Authentication


    Bearer-protected endpoints require:


    ```

    Authorization: Bearer

    ```


    Tokens are obtained via `POST /v1/auth/anonymous` or `POST /v1/auth/login-email`.


    Public endpoints (no token required): `POST /submit`, `POST /v1/apis` (auth optional, enables submission attribution), `POST /v1/auth/anonymous`, `POST /v1/auth/refresh`, `POST /v1/auth/revoke`, `POST /v1/auth/login-email`, `GET /v1/recently-added`, `GET /v1/recommend` (auth optional, personalizes with bookmarks), `GET /v1/apis/{slug}`, `GET /v1/apis/{id}/alternatives`, `GET /v1/trust-scores/{id}`, `GET /v1/apis/compare`, `GET /v1/change-feed`, `GET /v1/use-case-collections`, categories (unversioned and `/v1` aliases), `GET /search`, `GET /metadata`, `POST /track`, and `POST /admin/v1/contact-messages`. Every other `/v1/*` operation requires a Bearer token.


    ## Account Types

    - **Anonymous**: Device-only, no email. Data tied to device fingerprint.

    - **Email-linked**: Has email + password. Can login from any device. Data merges on link.


    ## Token Lifecycle

    - **Access token**: 15 minutes, used for API requests

    - **Refresh token**: 30 days, used to rotate access tokens

    - Refreshing a token invalidates the old one (single-use rotation)

    - Revoking deactivates all tokens for a device'
  version: 1.0.0
  contact:
    name: Public APIs
    url: '---'
servers:
- url: http://localhost:4000
  description: Local development
- url: '---'
  description: Production
tags:
- name: Tracking
  description: Page event tracking
paths:
  /track:
    post:
      tags:
      - Tracking
      summary: Track page events
      description: Batch insert page view / interaction events. Accepts a single event object or an array of up to 50 events. Client IP and user-agent are captured automatically.
      operationId: trackEvents
      requestBody:
        required: true
        content:
          application/json:
            schema:
              oneOf:
              - $ref: '#/components/schemas/TrackEventRequest'
              - $ref: '#/components/schemas/TrackEventsBatchRequest'
      responses:
        '200':
          description: Events recorded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TrackResponse'
        '400':
          description: No events provided
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  schemas:
    TrackEventsBatchRequest:
      type: object
      description: Batch of page events (max 50)
      properties:
        events:
          type: array
          items:
            $ref: '#/components/schemas/TrackEventRequest'
          maxItems: 50
    Error:
      type: object
      properties:
        error:
          type: string
      required:
      - error
    TrackResponse:
      type: object
      properties:
        ok:
          type: boolean
          example: true
        count:
          type: integer
          description: Number of events recorded
    TrackEventRequest:
      type: object
      description: Single page event
      properties:
        eventType:
          type: string
          maxLength: 50
          description: Event type (e.g. page_view, click). Aliased as `event`.
        path:
          type: string
          maxLength: 500
          description: Page path
        element:
          type: string
          maxLength: 500
          description: UI element identifier
        metadata:
          type: object
          description: Arbitrary metadata
        sessionId:
          type: string
          maxLength: 100
          description: Client session ID
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Anonymous device access token from POST /v1/auth/anonymous