Skip to content
dropin

Overview

dropin-activity 1.0.0

Section titled “dropin-activity 1.0.0”

Activity feeds as a service. Feeds follow feeds; activities fan out along follow edges; users react to activities.

Auth: HS256 bearer JWT signed by the tenant’s backend with their api_secret. We issue no tokens and store no credentials.

Information

  • OpenAPI version: 3.1.0

Operations

Section titled “Operations”
GET
/v1/health
GET
/v1/health/ready
GET
/v1/health/fanout
GET
/v1/health/notify
GET
/v1/feeds/{group}/{id}
GET
/v1/feeds/{group}/{id}/head
POST
/v1/feeds/{group}/{id}/activities
DELETE
/v1/feeds/{group}/{id}/activities
DELETE
/v1/activities/{id}
PATCH
/v1/activities/{id}
GET
/v1/feeds/{group}/{id}/follows
POST
/v1/feeds/{group}/{id}/follows
DELETE
/v1/feeds/{group}/{id}/follows/{tGroup}/{tId}
GET
/v1/feeds/{group}/{id}/followers
GET
/v1/feeds/{group}/{id}/stats
GET
/v1/feeds/{group}/{id}/suggestions
GET
/v1/activities/{id}/reactions
POST
/v1/activities/{id}/reactions
DELETE
/v1/activities/{id}/reactions/{kind}
DELETE
/v1/reactions/{reactionId}
GET
/v1/activities/{id}/comments
POST
/v1/activities/{id}/comments
GET
/v1/comments/{id}/replies
DELETE
/v1/comments/{id}
PATCH
/v1/comments/{id}
GET
/v1/notifications
GET
/v1/notifications/head
POST
/v1/notifications/mark
GET
/v1/users/me
POST
/v1/users
POST
/v1/users/{id}/revoke-tokens
GET
/v1/webhooks
POST
/v1/webhooks
DELETE
/v1/webhooks/{id}
POST
/v1/batch/users
POST
/v1/batch/follows
POST
/v1/batch/activities
GET
/v1/promoted
POST
/v1/promoted
DELETE
/v1/promoted/{id}
GET
/v1/objects
GET
/v1/objects/{type}/{id}
PUT
/v1/objects/{type}/{id}
DELETE
/v1/objects/{type}/{id}
PATCH
/v1/objects/{type}/{id}
POST
/v1/batch/objects
GET
/admin/tenants
POST
/admin/tenants
GET
/admin/tenants/{id}
DELETE
/admin/tenants/{id}
POST
/admin/tenants/{id}/status
POST
/admin/tenants/{id}/rotate-secret
GET
/admin/health
POST
/admin/operators
POST
/operator/login
POST
/operator/invite/accept
GET
/operator/me
GET
/operator/tenant
POST
/operator/tenant/rotate-secret
GET
/operator/team
POST
/operator/team
PATCH
/operator/team/{id}
POST
/operator/team/{id}/disable
POST
/operator/team/{id}/enable
GET
/operator/inspect/activities
GET
/operator/inspect/users
GET
/operator/inspect/feeds/{group}/{id}
GET
/operator/inspect/feeds/{group}/{id}/follows
GET
/operator/inspect/feeds/{group}/{id}/followers
GET
/operator/inspect/feeds/{group}/{id}/stats
GET
/operator/inspect/head
GET
/operator/webhooks/events
GET
/operator/webhooks/destinations
POST
/operator/webhooks/test

Authentication

Section titled “Authentication”

bearerAuth

Section titled “bearerAuth”

Security scheme type: http

Bearer format: JWT

operatorToken

Section titled “operatorToken”

The ONLY way to authenticate /admin/* in production. The shared X-Admin-Key header this API used to accept is gone: ADMIN_KEY is unset in production, so the gateway ignores the header and the request is rejected like any other unauthenticated one. Platform staff accounts are created at a shell on the host with pnpm operator:seed — there is no route that mints one. See docs/superpowers/specs/2026-08-12-staff-seeding-design.md.

Operator session token from POST /operator/login. Distinct from tenant user tokens: different secret, issuer dropin-operator, and aud=operator. Carries only the operator id — role and tenant are read from the database on every request.

On /admin/** only a staff operator’s token is accepted; an owner’s or member’s token is rejected there, so this scheme appearing on a route does not mean every operator can call it.

Security scheme type: http

Bearer format: JWT