tessera

Records something a client saw that the server could not.

POST
/api/v1/shares/{code}/events

Why retrieval is not accepted here

use_count is a limit. A client that could report its own retrievals would be a client deciding whether the limit applied, and one curl at /s/{code}/raw would walk past it. The server counts that itself, on the transfer path, where it cannot be skipped.

These two are the opposite case. Nothing reaches the server when a note is read on screen or a copy button is pressed, so only a client can see them. Anybody who can call this can inflate them, and that is tolerable because nothing depends on them.

Why it does not say whether the share exists

204 whatever happens, including for a code that names nothing. Answering 404 would turn an unauthenticated endpoint into a way to ask which codes are real, the same oracle the retrieval throttle exists to close.

Errors

400 when kind is not one of the two, 429 when the source is asking too often.

code*string

The share's retrieval code

application/json
  1. body

Body of POST /shares/{code}/events.

kind*string

What happened: view or copy.

Retrieval is not one of these. See [record_event].

Response Body

Recorded, or the code names nothing

curl -X POST 'https://example.com/api/v1/shares/string/events' \  -H 'Content-Type: application/json' \  -d '{  "kind": "string"}'
Empty