Clanker: Remove development history and server internals

2026-10-24T17:16:13Z

Remove development history and server internals

Clanker: Protocol v25 reference

2026-10-24T16:41:00Z

Protocol v25 reference

Show changes

Clanker: Clanker moved page SimTX API/Account service to SimTX API v24/Account service: Archive the v24 protocol reference

2026-10-24T16:11:45Z

Clanker moved page SimTX API/Account service to SimTX API v24/Account service: Archive the v24 protocol reference

New page

#REDIRECT [[SimTX API v24/Account service]]

← Older revision		Revision as of 17:16, 24 October 2026
Line 51:		Line 51:
	\|}		\|}

	Endpoints under <code>/api/v1/me/</code>, <code>/api/v1/auth/</code> and the device approval endpoints (<code>/api/v1/device/verify</code>, <code>/api/v1/device/deny</code>, <code>GET /api/v1/device/authorizations/{userCode}</code>) belong to the account website. They require a browser session cookie and a CSRF token and do not accept bearer credentials; the website's station pages use <code>/api/v1/me/stations</code> and <code>/api/v1/me/satellites</code> with the same bodies as the bearer endpoints. Administrative and internal endpoints are not part of the public API and are not documented here.		Endpoints under <code>/api/v1/me/</code>, <code>/api/v1/auth/</code> and the device approval endpoints (<code>/api/v1/device/verify</code>, <code>/api/v1/device/deny</code>, <code>GET /api/v1/device/authorizations/{userCode}</code>) belong to the account website. They require a browser session cookie and a CSRF token and do not accept bearer credentials.

	== Conventions ==		== Conventions ==
	* '''Transport.''' HTTPS only. Request and response bodies are <code>application/json</code> (UTF-8) unless stated otherwise. Timestamps are ISO-8601 strings in UTC, for example <code>2026-10-24T12:00:00Z</code>.		* '''Transport.''' HTTPS only. Request and response bodies are <code>application/json</code> (UTF-8) unless stated otherwise. Timestamps are ISO-8601 strings in UTC, for example <code>2026-10-24T12:00:00Z</code>.
	* '''Field names''' are camelCase. Null fields are omitted. ~~Unknown~~ response fields ~~may be added in future and must be ignored by clients~~.		* '''Field names''' are camelCase. Null fields are omitted. Clients must ignore unknown response fields.
	* '''Caching.''' Every <code>/api/</code> response carries <code>Cache-Control: no-store</code>, except the public satellite list, which supports <code>ETag</code> revalidation.		* '''Caching.''' Every <code>/api/</code> response carries <code>Cache-Control: no-store</code>, except the public satellite list, which supports <code>ETag</code> revalidation.
	* '''Timeouts.''' ~~The official clients use~~ a 5 second connect timeout and a 10 second request timeout~~. Those values are a sensible default~~.		* '''Timeouts.''' Use a 5 second connect timeout and a 10 second request timeout.
	* '''Request IDs.''' A client may send an <code>X-Request-ID</code> header matching <code>[A-Za-z0-9._-]{8,64}</code>. The service echoes it in the response header and in error bodies. Without one, the service generates a UUID. Quote it when reporting a problem.		* '''Request IDs.''' A client may send an <code>X-Request-ID</code> header matching <code>[A-Za-z0-9._-]{8,64}</code>. The service echoes it in the response header and in error bodies. Without one, the service generates a UUID. Quote it when reporting a problem.
	* '''Body size.''' Station, antenna, rig and launch bodies are limited to 2 MiB (<code>413 request_too_large</code>).		* '''Body size.''' Station, antenna, rig and launch bodies are limited to 2 MiB (<code>413 request_too_large</code>).
Line 93:		Line 93:
	\|}		\|}

	A user code (shown to the person signing in) has the form <code>ABCD-EF23</code>: eight characters from the alphabet <code>ABCDEFGHJKLMNPQRSTUVWXYZ23456789</code>, with a hyphen after the fourth. The alphabet omits <code>I</code>, <code>O</code>, <code>0</code> and <code>1</code>~~, so nobody has to wonder which one they are looking at~~.		A user code (shown to the person signing in) has the form <code>ABCD-EF23</code>: eight characters from the alphabet <code>ABCDEFGHJKLMNPQRSTUVWXYZ23456789</code>, with a hyphen after the fourth. The alphabet omits <code>I</code>, <code>O</code>, <code>0</code> and <code>1</code>.

	=== Storing credentials ===		=== Storing credentials ===
	* Keep the access credential in memory only. It expires after ten minutes ~~in any case~~.		* Keep the access credential in memory only. It expires after ten minutes.
	* Persist the refresh credential (or a personal credential) in the operating system's credential store, such as Keychain, Windows Credential Manager or Secret Service.		* Persist the refresh credential (or a personal credential) in the operating system's credential store, such as Keychain, Windows Credential Manager or Secret Service.
	* There is no client-side logout endpoint. Signing out means deleting the stored refresh credential. Users revoke devices and personal credentials on the account website.		* There is no client-side logout endpoint. Signing out means deleting the stored refresh credential. Users revoke devices and personal credentials on the account website.

SimTX API/Account service - Revision history

Clanker: Remove development history and server internals

Clanker: Protocol v25 reference

Clanker: Clanker moved page SimTX API/Account service to SimTX API v24/Account service: Archive the v24 protocol reference