Signal Accounts API

openapi: 3.1.0
info:
  title: Signal Server Accounts API
  description: The Signal Server API is the backend REST API that supports the Signal Private Messenger applications on Android, Desktop, and iOS. Built as a Dropwizard application, it provides REST controllers for account registration and management, message delivery, pre-key bundle distribution, device provisioning, profile management, and attachment handling. The server handles user registration via phone number verification, encrypted message routing, push notification delivery, and pre-key bundle management. While Signal does not offer an official public REST API for third-party use, the server source code is available for inspection and self-hosting. All communication is end-to-end encrypted using the Signal Protocol.
  version: '2.0'
  contact:
    name: Signal Support
    url: https://support.signal.org/
  termsOfService: https://signal.org/legal/
  license:
    name: AGPL-3.0
    url: https://github.com/signalapp/Signal-Server/blob/main/LICENSE
servers:
- url: https://chat.signal.org
  description: Signal Production Server
security:
- basicAuth: []
tags:
- name: Accounts
  description: Account management endpoints for configuring account settings, managing capabilities, and account lifecycle operations.
paths:
  /v1/accounts/whoami:
    get:
      operationId: getAccountIdentity
      summary: Get current account identity
      description: Returns the account identity information for the currently authenticated user, including the account UUID and phone number.
      tags:
      - Accounts
      responses:
        '200':
          description: Account identity returned successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccountIdentity'
        '401':
          description: Authentication required
  /v1/accounts/attributes:
    put:
      operationId: setAccountAttributes
      summary: Set account attributes
      description: Updates the account attributes for the authenticated user, including registration ID, voice and video capabilities, fetches messages setting, and other account-level configuration.
      tags:
      - Accounts
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccountAttributes'
      responses:
        '204':
          description: Account attributes updated successfully
        '401':
          description: Authentication required
  /v1/accounts/username_hash/{usernameHash}:
    put:
      operationId: confirmUsernameHash
      summary: Confirm a username hash
      description: Confirms and sets a username hash for the authenticated account. The username hash is a privacy-preserving representation of the username.
      tags:
      - Accounts
      parameters:
      - $ref: '#/components/parameters/usernameHash'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UsernameHashConfirmation'
      responses:
        '200':
          description: Username hash confirmed successfully
        '409':
          description: Username hash already taken
        '410':
          description: Username hash reservation expired
    get:
      operationId: lookupUsernameHash
      summary: Look up account by username hash
      description: Looks up an account by its username hash and returns the account UUID if found.
      tags:
      - Accounts
      parameters:
      - $ref: '#/components/parameters/usernameHash'
      responses:
        '200':
          description: Account found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UsernameHashLookupResponse'
        '404':
          description: No account found for username hash
  /v1/accounts/number:
    put:
      operationId: changeNumber
      summary: Change account phone number
      description: Changes the phone number associated with the authenticated account. Requires re-verification of the new phone number.
      tags:
      - Accounts
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ChangeNumberRequest'
      responses:
        '200':
          description: Phone number changed successfully
        '401':
          description: Authentication required
        '409':
          description: Number already in use
components:
  parameters:
    usernameHash:
      name: usernameHash
      in: path
      required: true
      description: The Base64url-encoded SHA-256 hash of the username.
      schema:
        type: string
  schemas:
    AccountAttributes:
      type: object
      properties:
        fetchesMessages:
          type: boolean
          description: Whether the device fetches messages via WebSocket rather than receiving push notifications.
        registrationId:
          type: integer
          description: The Signal Protocol registration ID for this device.
        pniRegistrationId:
          type: integer
          description: The PNI registration ID for this device.
        name:
          type: string
          description: The encrypted device name, Base64-encoded.
        capabilities:
          type: object
          description: Account capability flags indicating supported features.
          properties:
            storage:
              type: boolean
              description: Whether the account supports secure value recovery and storage service.
            transfer:
              type: boolean
              description: Whether the device supports account transfer.
            paymentActivation:
              type: boolean
              description: Whether the account supports payment activation.
        unidentifiedAccessKey:
          type: string
          description: The Base64-encoded unidentified access key for sealed sender.
        unrestrictedUnidentifiedAccess:
          type: boolean
          description: Whether any sender can use sealed sender without the access key.
    ChangeNumberRequest:
      type: object
      required:
      - number
      - registrationLock
      properties:
        number:
          type: string
          description: The new E164-formatted phone number.
        registrationLock:
          type: string
          description: The registration lock token for verification.
        pniIdentityKey:
          type: string
          description: The new PNI identity key, Base64-encoded.
    UsernameHashLookupResponse:
      type: object
      properties:
        uuid:
          type: string
          format: uuid
          description: The UUID of the account associated with the username hash.
    AccountIdentity:
      type: object
      properties:
        uuid:
          type: string
          format: uuid
          description: The ACI (Account Identity) UUID.
        number:
          type: string
          description: The E164-formatted phone number.
        pni:
          type: string
          format: uuid
          description: The Phone Number Identity UUID.
        usernameHash:
          type: string
          description: The Base64url-encoded username hash if set.
    UsernameHashConfirmation:
      type: object
      required:
      - usernameHash
      - zkProof
      properties:
        usernameHash:
          type: string
          description: The Base64url-encoded username hash to confirm.
        zkProof:
          type: string
          description: The zero-knowledge proof that the username hash is valid.
  securitySchemes:
    basicAuth:
      type: http
      scheme: basic
      description: HTTP Basic authentication using the account UUID (or phone number) and password. The password is established during account registration.
    bearerAuth:
      type: http
      scheme: bearer
      description: Bearer token authentication used for certain provisioning and registration flows.
externalDocs:
  description: Signal Server Source Code
  url: https://github.com/signalapp/Signal-Server