Follow a tag (bookmark it into your browse rail)

POST

/tags/{tag}/follow

• Local development behind nginx (port 8088 by default)

Adds the caller to tag_follows (#1123). Authentication is the only gate.

A follow is a BOOKMARK, not a grant

It grants nothing. It is never read by any authorization rule, and following a tag does not widen one row of what you can see. What it does is put a # chip in your browse rail and add a third source to the Following feed — posts carrying a tag you follow, INTERSECTED with what you could already read, never unioned with it.

That distinction is sharper for tags than for teams and users, because a tag’s other side is written by whoever authored the post: anyone may tag their own restricted post fantasy. The Following filter is therefore ANDed beside the post read rule rather than ORed into it, so a restricted post carrying a tag you follow stays exactly as invisible as it was.

No capability, and no existence check

Team follows require teams.read because that is what lets you see a team at all. A tag needs no such gate: it is a free string, and the feed it feeds is already gated by the post read rule.

There is deliberately no “does this tag exist” probe either — following a tag nobody has used is legal and inert until somebody uses it. A probe would have to answer from a corpus spanning posts the caller cannot read, which would make this endpoint an oracle enumerating the tags of private work one guess at a time.

Idempotent

Following a tag you already follow is a no-op 204, not a 409.

Authorizations

• cookieAuth
• bearerAuth

Parameters

Path Parameters

tag

required

string

>= 1 characters <= 200 characters

The tag itself, URL-encoded. Tags are a CORPUS rather than an entity — post_tags has no id to address one by — so the string is the identifier.

Matching against the corpus is EXACT, because GET /posts’s tag filter is exact. The server trims surrounding whitespace (the same normalisation post_tags writes apply) and does nothing else: folding case here would give the reader a rail chip whose ?tag= filter finds nothing while their Following feed fills with differently-cased posts. Unifying case across the corpus is the #789 vocabulary arc’s decision.

Responses

204

Followed (or already following)

400

Malformed request

object

error

required

Human-readable error summary

string

Example

the request could not be completed

401

Authentication required, missing, or invalid

object

error

required

Human-readable error summary

string

Example

the request could not be completed

Example

{
  "error": "authentication required: sign in and retry with a valid session or API token"
}

500

Unexpected server error

object

error

required

Human-readable error summary

string

Example

the request could not be completed