Public profile by username (the human-facing permalink)

GET

/users/by-username/{username}

• Local development behind nginx (port 8088 by default)

Public user-profile page (#478, ADR 0070). Anonymous-visible when public mode is on (ADR 0063 — gated centrally); requires auth when public mode is off. Anonymous viewers get only the display-layer fields (no real name), and a 404 when the owner has opted out of anonymous exposure (ADR 0024). The profile’s content lists are fetched separately through the standard gated browse endpoints (/assets, /collections, /posts) filtered by owner_ref, so there is no new enforcement plane here.

Parameters

Path Parameters

username

required

string

<= 64 characters

Responses

200

Public profile

Merged user + profile view. display_name is the resolved display string, first non-empty of:

authenticated: profile.display_name → user.fullname → username anonymous: profile.display_name → username

The anonymous ladder skips fullname, and has since #478 — real name is authenticated-only (ADR 0070 §3), so a fallback that reached it would defeat that rule silently, for exactly the users who never set a display name. This sentence used to describe only the authenticated ladder, which made the schema the stale source; the rule itself is one Go expression (users.ResolveDisplayName), shared with PostAuthor.

avatar_url is null for users without an uploaded avatar; the frontend renders a generated initials disc in that case.

object

ref

required

integer format: int64

username

required

string

fullname

The raw user.fullname value, for the rare case a caller needs the unresolved string (account settings page). Most UI surfaces should use display_name instead.

string

nullable

display_name

required

Resolved display string ready to render — never empty.

string

bio

string

avatar_url

string

nullable

location

string

website_url

string format: uri

nullable

social_links

Free-form platform → handle map. Frontend renders known platforms (twitter, instagram, artstation, …) as icon links; unknown keys are ignored.

object

key

additional properties

string

language

IETF BCP47 language tag (e.g. “en”, “es-AR”). Empty string = “use system / browser default”. Drives the i18n switcher in the user menu.

string

theme

UI theme preference. system follows the OS; empty string = no stored preference. Persisted alongside the profile so it follows the user across browsers (#677).

string

Allowed values: "" light dark system

member_since

required

string format: date-time

post_count

required

Total live posts authored by this user.

integer format: int64

origin_server_id

Set on profiles mirroring a remote site’s user. NULL = locally-owned account.

string format: uuid

nullable

401

Authentication required, missing, or invalid

object

error

required

Human-readable error summary

string

Example

the request could not be completed

Example

{
  "error": "authentication required: sign in and retry with a valid session or API token"
}

404

Resource not found

object

error

required

Human-readable error summary

string

Example

the request could not be completed