Overview

artist-alley API (0.6.0)

The Artist Alley REST API. Every endpoint lives under the /api/v1 base path and speaks JSON.

Authenticating

Most endpoints need a signed-in caller. There are two ways:

• Session cookie — POST /auth/login with a username and password sets a user session cookie. Browser clients use this automatically.
• API token — from a signed-in session, POST /auth/tokens mints a personal access token that looks like aa_pat_…. Send it on every request: Authorization: Bearer aa_pat_…. Tokens carry scopes and an optional expiry, so you can limit a script to just the endpoints it needs.

A first request

curl https://your-instance/api/v1/me \
  -H "Authorization: Bearer aa_pat_your_token_here"

Errors

An error returns the matching HTTP status — 400 (bad request), 401 (not signed in), 403 (missing capability), 404 (not found), 409 (conflict), 422 (unprocessable), 429 (rate-limited), 500 (server error) — with a JSON body of the shape { "error": "…" }, a short human-readable summary. Each endpoint page lists the statuses it can return.

• OpenAPI version: 3.0.3

Authentication

cookieAuth

PHP-compatible session cookie issued by /auth/login. The cookie name user is the one RS reads (include/authenticate.php), which is why we keep it for now; rename happens once PHP is fully retired.

Security scheme type: apiKey

Cookie parameter name: user

bearerAuth

Personal Access Token, format aa_pat_<32 chars>. Issued via POST /auth/tokens. Send as Authorization: Bearer aa_pat_....

Security scheme type: http

Bearer format: aa_pat